New Collision Attacks on SHA-1 Based on Optimal Joint Local-Collision Analysis
The main contributions of this paper are two-fold.
Firstly, we present a novel direction in the cryptanalysis of the cryptographic hash function SHA-1. Our work builds on previous cryptanalytic efforts on SHA-1 based on combinations of local collisions. Due to dependencies, previous approaches used heuristic corrections when combining the success probabilities and message conditions of the individual local collisions. Although this leads to success probabilities that are seemingly sufficient for feasible collision attacks, this approach most often does not lead to the maximum success probability possible as desired. We introduce novel techniques that enable us to determine the theoretical maximum success probability for a given set of (dependent) local collisions, as well as the smallest set of message conditions that attains this probability. We apply our new techniques and present an implemented open-source near-collision attack on SHA-1 with a complexity equivalent to 257.5 SHA-1 compressions.
Secondly, we present an identical-prefix collision attack and a chosen-prefix collision attack on SHA-1 with complexities equivalent to approximately 261 and 277.1 SHA-1 compressions, respectively.
- [Che11]Chen, R.: New Techniques for Cryptanalysis of Cryptographic Hash Functions, Ph.D. thesis, Technion (August 2011)Google Scholar
- [Coc07]Cochran, M.: Notes on the Wang et al. 263 SHA-1 Differential Path, Cryptology ePrint Archive, Report 2007/474 (2007)Google Scholar
- [GA11]Grechnikov, E.A., Adinetz, A.V.: Collision for 75-step SHA-1: Intensive Parallelization with GPU, Cryptology ePrint Archive, Report 2011/641 (2011)Google Scholar
- [Gre10]Grechnikov, E.A.: Collisions for 72-step and 73-step SHA-1: Improvements in the Method of Characteristics, Cryptology ePrint Archive, Report 2010/413 (2010)Google Scholar
- [MHP09]McDonald, C., Hawkes, P., Pieprzyk, J.: Differential Path for SHA-1 with complexity O(252), Cryptology ePrint Archive, Report 2009/259 (2009)Google Scholar
- [MRR07]Mendel, F., Rechberger, C., Rijmen, V.: Update on SHA-1, Rump session of CRYPTO 2007 (2007)Google Scholar
- [PCTH11]Polk, T., Chen, L., Turner, S., Hoffman, P.: Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms, Internet Request for Comments, RFC 6194 (March 2011)Google Scholar
- [Ste12a]Stevens, M.: Attacks on Hash Functions and Applications, Ph.D. thesis, Leiden University (June 2012)Google Scholar
- [Ste12b]Stevens, M.: SHA-1 near collision attack source code (2012), https://hashclash.googlecode.com/files/sha1_nearcoll_attack.zip
- [WFLY04]Wang, X., Feng, D., Lai, X., Yu, H.: Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD, Cryptology ePrint Archive, Report 2004/199 (2004)Google Scholar
- [WYY05a]Wang, X., Yao, A.C., Yao, F.: Cryptanalysis on SHA-1, NIST Cryptographic Hash Workshop Presentation (2005)Google Scholar