Narrow T-Functions

  • Magnus Daum
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3557)


T-functions were introduced by Klimov and Shamir in a series of papers during the last few years. They are of great interest for cryptography as they may provide some new building blocks which can be used to construct efficient and secure schemes, for example block ciphers, stream ciphers or hash functions.

In the present paper, we define the narrowness of a T-function and study how this property affects the strength of a T-function as a cryptographic primitive. We define a new data strucure, called a solution graph, that enables solving systems of equations given by T-functions. The efficiency of the algorithms which we propose for solution graphs depends significantly on the narrowness of the involved T-functions. Thus the subclass of T-functions with small narrowness appears to be weak and should be avoided in cryptographic schemes.

Furthermore, we present some extensions to the methods of using solution graphs, which make it possible to apply these algorithms also to more general systems of equations, which may appear, for example, in the cryptanalysis of hash functions.


Cryptanalysis hash functions solution graph T-functions w-narrow 


  1. 1.
    Daum, M.: Cryptanalysis of Hash Functions of the MD4-Family. PhD Thesis, Ruhr-University Bochum (in preparation)Google Scholar
  2. 2.
    Daum, M.: Narrow T-functions. Cryptology ePrint Archive, Report 2005/016 (available under,
  3. 3.
    Dobbertin, H.: The status of MD5 after a recent attack. CryptoBytes 2(2), 1–6 (1996)MathSciNetGoogle Scholar
  4. 4.
    Dobbertin, H.: RIPEMD with two-round compress function is not collision-free. Journal of Cryptology 10, 51–68 (1997)zbMATHCrossRefGoogle Scholar
  5. 5.
    Dobbertin, H.: Cryptanalysis of MD4. Journal of Cryptology 11, 253–274 (1998)zbMATHCrossRefGoogle Scholar
  6. 6.
    Klimov, A., Shamir, A.: A new class of invertible mappings. In: Kaliski Jr., B.S., Koç, Ç.K., Paar, C. (eds.) CHES 2002. LNCS, vol. 2523, pp. 470–483. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  7. 7.
    Klimov, A., Shamir, A.: Cryptographic Applications of T-functions. In: Matsui, M., Zuccherato, R.J. (eds.) SAC 2003. LNCS, vol. 3006. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  8. 8.
    Klimov, A.B., Shamir, A.: New cryptographic primitives based on multiword T-functions. In: Roy, B., Meier, W. (eds.) FSE 2004. LNCS, vol. 3017. pp. 1–15. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  9. 9.
    Klimov, A.: Applications of T-functions in Cryptography. PhD Thesis, Weizmann Institute of Science (2004) (submitted) , available under
  10. 10.
    Wegener, I.: Branching Programs and Binary Decision Diagrams: Theory and Applications. In: SIAM Monographs on Discrete Mathematics and Applications (2000)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Magnus Daum
    • 1
  1. 1.CITS Research Group, Ruhr-University Bochum 

Personalised recommendations