Cryptology ePrint Archive: Report 2012/278

Improved Indifferentiability Security Bound for the JH Mode

Dustin Moody and Souradyuti Paul and Daniel Smith-Tone

Abstract: Indifferentiability security of a hash mode of operation guarantees the mode's resistance against all (meaningful) generic attacks. It is also useful to establish the security of protocols that use hash functions as random functions. The JH hash function is one of the five finalists in the ongoing NIST SHA-3 hash function competition. Despite several years of analysis, the indifferentiability security of the JH mode (with n-bit digest and 2n-bit permutation) has remained remarkably low, only at n/3 bits (FSE 2010), while the other four finalist modes -- with comparable parameter values -- offer a security guarantee of n/2 bits. In this paper, we improve the indifferentiability security bound for the JH mode to n/2 bits (e.g. from 171 to 256 bits when n=512). To put this into perspective, our result guarantees the absence of attacks on both JH-256 and JH-512 hash functions with time less than approximately 2^{256} computations of the underlying 1024-bit permutation, under the assumption that the basic permutation is structurally strong. Our bounds are optimal for JH-256, and the best, so far, for JH-512. We obtain this improved bound by establishing an isomorphism of certain query-response graphs through a careful design of the simulators and the bad events. Our experimental data strongly supports the theoretically obtained results.

Category / Keywords: secret-key cryptography / Hash Mode, NIST SHA-3 Competition, JH, Indifferentiability

Original Publication (with minor differences): DESIGN CODES AND CRYPTOGRAPHY
DOI: 10.1007/s10623-015-0047-9

Date: received 16 May 2012, last revised 15 Jul 2015

Contact author: souradyutip at iitgn ac in

Available format(s): Postscript (PS) | Compressed Postscript (PS.GZ) | PDF | BibTeX Citation

Note: A few more references were added on the related work after taking into consideration the third-party comments and remarks.

Version: 20150715:084943 (All versions of this report)

Short URL: ia.cr/2012/278

Discussion forum: Show discussion | Start new discussion