Presentation is loading. Please wait.

Presentation is loading. Please wait.

Applications of SAT Solvers to Cryptanalysis of Hash Functions Ilya Mironov Lintao Zhang Microsoft Research Silicon Valley Campus.

Similar presentations


Presentation on theme: "Applications of SAT Solvers to Cryptanalysis of Hash Functions Ilya Mironov Lintao Zhang Microsoft Research Silicon Valley Campus."— Presentation transcript:

1 Applications of SAT Solvers to Cryptanalysis of Hash Functions Ilya Mironov Lintao Zhang Microsoft Research Silicon Valley Campus

2 Overview 1.Crash course on hash functions 2.Collision-finding attacks (Wang et al. 05) 3.Automation via SAT solvers

3 Hash functions H: {0,1}*{0,1} n

4 Cryptographic hash functions -Several important properties -Collision-resistance x, y: H(x) = H(y)

5 Birthday paradox Finding collision: ~ |S| = 2 n/2 output H S

6 Security level Insecure: 2 64 operations Medium-term:2 80 Long-term (~20 years):2 128 Paranoid:2 256 hash output 128 bits 160 bits 256 bits 512 bits

7 Short history of hash functions 1990 Ron Rivest: MD4 (128-bit output) 1992 Ron Rivest:MD5 (128-bit output) 1993 NIST: SHA (Secure Hash Algorithm, 160 bits) 1995 NIST: Oops! SHA NIST:SHA-256,384,512 0

8 1990MD MD5 1993SHA SHA SHA-256,384, MD4 is broken theoretical attack on SHA0 MD5, SHA0 broken, theoretical attack on SHA1 SHA1 MD5 MD4

9 MD4 and MD5s structure - Basic building block: 512 bits 128 bits 48 rounds compression function

10 Compression functions building block rounds 0-15 a b c d M rounds rounds bits = bit words 128 bits = 4 32-bit words 128 bits w

11 One round

12 Internal variables M = (M 0,M 1,…,M 15 ) (w 0,w 1,…,w 47 ) (a 0,b 0,c 0,d 0 ) (a 1,b 1,c 1,d 1 ) (a 2,b 2,c 2,d 2 ) … (a 48,b 48,c 48,d 48 )

13 Finding a collision [Wang et al05] Goal: Find M, M' such that H(M) = H(M') 1. Select message difference M' = M + 2. Select differential path b i ' = b i + b i 3. Find sufficient conditions 4. Make them happen!

14 Disturbance vector rounds 0-15 a b c d M rounds rounds 31-48

15 Differential path M (a 0,b 0,c 0,d 0 ) b 1 b 2 … b 48 M' (a 0,b 0,c 0,d 0 ) b 1 ' b 2 ' … b 48 ' differential path b 1 ' = b 1 + b 1 b 2 ' = b 2 + b 2 … b 48 ' = b 48 + b 48

16 Sufficient conditions (a i,b i,c i,d i ) (d i,(a i +f i (b i,c i,d i )+w i +K i )<<

17 Sufficient conditions [Wang et al.] MD4: 122 MD5: first block 294; second block 309 SHA0: 260

18 Message modification technique rounds 0-15 a b c d rounds rounds

19 Probabilistic method Conditions satisfied with probability 50% * : MD4: < 8 MD5: first block 37; second block 30 SHA0: 42 SHA1: 70 * In the original papers (better attacks are currently known)

20 SAT Solvers! Goal: Find M, M' such that H(M) = H(M') 1. Select message difference M' = M + 2. Select differential path b i ' = b i + b i 3. Find sufficient conditions 4. Message modifications

21 MD4 53K variables, 221K clauses. Success! SatELiteGTI < 500 sec 0xe1c08802 d f3fdc66f df b5c048 06c516c5 b632403a 88e2fdd5 900f8005 3f b fad83a 01d f200a8 94ab dd7d collides with 0xe1c fdc66f df b5c048 06c516c5 b632403a 88e2fdd5 900f8005 3f b fad83a 01d f200a8 94ab dd7d

22 MD5 Hmm… Truncated MD5? truncated MD5 CNF formula SAT solver filter solution

23 Probabilistic method all messages reduced-round solutions full solutions

24 Where to truncate? ~100 hours per full solution

25 Collision in MD5 0x d685de69 e985b795 b4320c10 cd c014ca29 850b7d6d 0934ad afd0 aa480edf e4fc0320 7bb68ed1 3b505ddf 5e5d5df6 b539a48d fcb488ff adf d9fda4 d72a8fdc a887f4ca eec4f800 b75f8b20 7f1e9b51 9ab427cc 45c236f1 73f20086 e000005a 3b6550cc b6cc1c59 0fe9f71a a collides with 0x d685de69 e985b c10 cd c014ca29 850b7d6d 0934ad afd0 aa480edf e4fc0320 7bb68ed1 3b505ddf de5d5df6 b539a48d fcb488ff adf d9fda4 d72a8fdc a887f4ca eec4f800 b75f8b20 7f1e9b51 9ab427cc 45c236f1 73f20086 dfff805a 3b6550cc b6cc1c59 0fe9f71a a

26 Open problems -Cryptographic: -Break SHA-1 -Automate the entire attack -Other primitives -SAT-solving community: -No truncation! -SAT solvers optimized for cryptographic applications: XOR, multiplication, table look-ups, intuition

27 Conclusion -First serious SAT-solver-aided cryptanalytic effort -Several entries into SAT Race 06 -New applications and challenges


Download ppt "Applications of SAT Solvers to Cryptanalysis of Hash Functions Ilya Mironov Lintao Zhang Microsoft Research Silicon Valley Campus."

Similar presentations


Ads by Google