Higher-order differential properties of Keccak and Luffa

Christina Boura (1, 2) , Anne Canteaut (1) , Christophe de Cannière (3)

1 SECRET - Security, Cryptology and Transmissions
2 Gemalto [Meudon]
3 ESAT - Department of Electrical Engineering [Leuven]

In this paper, we identify higher-order differential and zero-sum properties in the full Keccak-f permutation, in the Luffa v1 hash function and in components of the Luffa v2 algorithm. These structural properties rely on a new bound on the degree of iterated permutations with a nonlinear layer composed of parallel applications of a number of balanced Sboxes. These techniques yield zero-sum partitions of size 2^{1575} for the full Keccak-f permutation and several observations on the Luffa hash family. We first show that Luffa v1 applied to one-block messages is a function of 255 variables with degree at most 251. This observation leads to the construction of a higher-order differential distinguisher for the full Luffa v1 hash function, similar to the one presented by Watanabe et al. on a reduced version. We show that similar techniques can be used to find all-zero higher-order differentials in the Luffa v2 compression function, but the additional blank round destroys this property in the hash function.

Mots clés: Hash functions; degree; higher-order differentials; zero-sums; SHA-3

Domaines: Cryptographie et sécurité [cs.CR]

Christina Boura, Anne Canteaut, Christophe de Cannière. Higher-order differential properties of Keccak and Luffa. Fast Software Encryption - FSE 2011, Feb 2011, Lyngby, Denmark. pp.252-269, ⟨10.1007/978-3-642-21702-9_15⟩. ⟨hal-00738195⟩