Cryptology ePrint Archive: Report 2007/474

Notes on the Wang et al. $2^{63}$ SHA-1 Differential Path

Martin Cochran

Abstract: Although advances in SHA-1 cryptanalysis have been made since the 2005 announcement of a $2^{63}$ attack by Wang et al., the details of the attack have not yet been presented or verified. This note does just that. Working from Adi Shamir's 2005 CRYPTO rump session presentation of Wang et al.'s work, this note verifies and presents the differential path and associated conditions. Although the error analysis for the advanced condition correction technique is not verified, a method is presented which yields a two-block collision attack on SHA-1 requiring an estimated $2^{62}$ SHA-1 computations if the original error analysis by Wang et al. is correct.

The differential path is presented for only the first block of the two-block attack, but the second block path likely differs from the first in only the first 10 steps and could be derived from the information presented here.

Category / Keywords: cryptographic protocols / Cryptographic Hash Functions, Cryptanalysis, SHA-1

Date: received 18 Dec 2007, last revised 10 Feb 2008

Contact author: Martin Cochran at colorado edu

Available formats: PDF | BibTeX Citation

Note: Corrected appearance in figures.

Version: 20080210:222819 (All versions of this report)

Discussion forum: Show discussion | Start new discussion