1. Fast Software Encryption 2007 1 Producing collisions for P ANAMA, instantaneously Joan Daemen and Gilles Van Assche STMicroelectronics

2. Fast Software Encryption 2007 2 Outline Introduction Structure of a collision in P ANAMA Properties of the non-linear function Transferring equations Backtracking cost Producing the collision Conclusion

3. Fast Software Encryption 2007 3 Structure of P ANAMA Chaining value (CV) Starts from 0 Iterate with input blocks CV size > input block size ( l i ) Do blank iterations Iterate with output blocks Output mapping Collision in the CV → collision Blank iterations make it difficult otherwise

4. Fast Software Encryption 2007 4 Collision in the chaining value Differential trail input differences CV differences Collision differential trail Initial CV difference = 0 Final CV difference = 0

5. Fast Software Encryption 2007 5 Inside P ANAMA = state + buffer

6. Fast Software Encryption 2007 6 Shape of the differential Buffer collisions Atom Rijmen et al. Our attack State injection Five instances of … sub-collisions

7. Fast Software Encryption 2007 7 Sub-collision in state Two-round differential trail completely determined by 3-block input difference sequence State difference Two differentials over 

8. Fast Software Encryption 2007 8 P ANAMA’s state updating function ½

9. Fast Software Encryption 2007 9 Differential over ° a 0 =0 a 1 =1 a 9 =1 a 10 +a 11 =0 a 11 +a 12 =1 a 12 =0

10. Fast Software Encryption 2007 10 Differential over ° Given differential ( a ', c ' ) Linear conditions on the absolute value a Simple condition (1 bit) or parity conditions (2 bits) Location of conditions only determined by a ' Number of conditions is w(a ' ), weight of a '

11. Fast Software Encryption 2007 11 Transferring conditions Immediate satisfaction Bridge

12. Fast Software Encryption 2007 12 Counting conditions and degrees of freedom w(a ' )-8

13. Fast Software Encryption 2007 13 The backtracking cost w(a')w(a')w(a ' )-8 0-8 0 0 124 91 146 6-2 2-6 113 91 0-8 max ∑ w(a ' )-8

14. Fast Software Encryption 2007 14 Bridging

15. Fast Software Encryption 2007 15 Dependency removal

16. Fast Software Encryption 2007 16 Producing the collision Choose a differential Least number of conditions to be bridged Work out the equations Immediate satisfaction Bridges Dependencies Finally, it takes 35 input blocks 30 bridges So a total of 65 evaluations of the round function

17. Fast Software Encryption 2007 17 Conclusion P ANAMA hash function is broken Source file to generate collisions available The way forward: R ADIO G ATÚN Feedback from state to buffer Lower number of input words per round Backtracking cost Ongoing http://radiogatun.noekeon.org/panama