|
|
| Line 14: |
Line 14: |
| | | | |
| | === Collision Attacks === | | === Collision Attacks === |
| − | <bibtex>
| |
| − | @misc{cryptoeprint:2006:098,
| |
| − | author = {Makoto Sugita, Mitsuru Kawazoe, Hideki Imai},
| |
| − | title = {Gr\"obner Basis Based Cryptanalysis of SHA-1},
| |
| − | howpublished = {Cryptology ePrint Archive, Report 2006/098},
| |
| − | year = {2006},
| |
| − | url = {http://eprint.iacr.org/2006/098},
| |
| − | abstract = {Recently, Wang proposed a new method to cryptanalyze SHA-1 and found collisions of $58$-round SHA-1. However many details of Wang's attack are still unpublished, especially, 1) How to find differential paths? 2) How to modify messages properly? For the first issue, some results have already been reported. In our article, we clarify the second issue and give a sophisticated method based on Gr\"obner basis techniques. We propose two algorithm based on the basic and an improved message modification techniques respectively. The complexity of our algorithm to find a collision for 58-round SHA-1 based on the basic message modification is $2^{29}$ message modifications and its implementation is equivalent to $2^{31}$ SHA-1 computation experimentally, whereas Wang's method needs $2^{34}$ SHA-1 computation. We propose an improved message modification and apply it to construct a more sophisticated algorithm to find a collision. The complexity to find a collision for 58-round SHA-1 based on this improved message modification technique is $2^8$ message modifications, but our latest implementation is very slow, equivalent to $2^{31}$ SHA-1 computation experimentally. However we conjecture that our algorithm can be improved by techniques of error correcting code and Gr\"obner basis. By using our methods, we have found many collisions for $58$-round SHA-1.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @misc{cryptoeprint:2004:364,
| |
| − | author = {Krystian Matusiewicz and Josef Pieprzyk},
| |
| − | title = {Finding good differential patterns for attacks on SHA-1},
| |
| − | howpublished = {Cryptology ePrint Archive, Report 2004/364},
| |
| − | year = {2004},
| |
| − | url = {http://eprint.iacr.org/2004/364},
| |
| − | abstract= {In this paper we describe a method of finding differential patterns that may be used to attack reduced versions of SHA-1. We show that the problem of finding optimal differential patterns for SHA-1 is equivalent to the problem of finding minimal weight codeword in a linear code. Finally, we present a number of patterns of different lengths suitable for finding collisions and near-collisions and discuss some bounds on minimal weights of them.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @misc{cryptoeprint:2005:350,
| |
| − | author = {Charanjit S. Jutla and Anindya C. Patthak},
| |
| − | title = {Is SHA-1 conceptually sound?},
| |
| − | howpublished = {Cryptology ePrint Archive, Report 2005/350},
| |
| − | year = {2005},
| |
| − | url = {http://eprint.iacr.org/2005/350},
| |
| − | abstract= {We argue that if the message expansion code of SHA-1 is replaced by a linear code with a better minimum distance, then the resulting hash function is collision resistant. To support this argument, we characterize the disturbance vectors which are used to build local collision attacks as a linear code. This linear code is the xor-sum of two codes, the message expansion code and a linear code representing the underlying block cipher in SHA-1. We also show that the following constraint satisfaction problem is $\np$-hard. The constraints are restricted to being XOR constraints, or Majority constraints on at most three variables each. The instances are further restricted by requiring that the constraints can be listed in a sequence C_1, C_2,...,C_m, such that for every constraint C_i, two of the variables in it occur only in constraints C_j, with |j-i|< 48. This problem is similar to the problem modeling the one-way function property of SHA-1. },
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @misc{cryptoeprint:2005:266,
| |
| − | author = {Charanjit S. Jutla and Anindya C. Patthak},
| |
| − | title = {A Matching Lower Bound on the Minimum Weight of SHA-1 Expansion Code},
| |
| − | howpublished = {Cryptology ePrint Archive, Report 2005/266},
| |
| − | year = {2005},
| |
| − | url = {http://eprint.iacr.org/2005/266},
| |
| − | abstract= {Recently, Wang, Yin, and Yu have used a low weight codeword in the SHA-1 message expansion to show a better than brute force method to find collisions in SHA-1. The codeword they used has a (bit) weight of 25 in the last 60 of the 80 expanded words. In this paper we show, using a computer assisted method, that this is indeed the smallest weight codeword. In particular, we show that the minimum weight over GF2 of any non-zero codeword in the SHA-1 (linear) message expansion code, projected on the last 60 words, is at least 25.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @misc{cryptoeprint:2005:247,
| |
| − | author = {Charanjit S. Jutla and Anindya C. Patthak},
| |
| − | title = {A Simple and Provably Good Code for SHA Message Expansion},
| |
| − | howpublished = {Cryptology ePrint Archive, Report 2005/247},
| |
| − | year = {2005},
| |
| − | url = {http://eprint.iacr.org/2005/247},
| |
| − | abstract = {We develop a new computer assisted technique for lower bounding the minimum distance of linear codes similar to those used in SHA-1 message expansion. Using this technique, we prove that a modified SHA-1 like code has minimum distance at least 82, and that too in just the last 64 of the 80 expanded words. Further the minimum weight in the last 60 words (last 48 words) is at least 75 (52 respectively). We propose a new compression function which is identical to SHA-1 except for the modified message expansion code. We argue that the high minimum weight of the message expansion code makes the new compression function resistant to recent differential attacks.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Yin2006Collision-ResistantUsageOf,
| |
| − | author = {Michael Szydlo and Yiqun Lisa Yin},
| |
| − | title = {Collision-Resistant Usage of MD5 and SHA-1 Via Message Preprocessing.},
| |
| − | booktitle = {CT-RSA 2006},
| |
| − | year = {2006},
| |
| − | pages = {99-114},
| |
| − | url = {http://dx.doi.org/10.1007/11605805_7},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {3860},
| |
| − | abstract = {A series of recent papers have demonstrated collision attacks on popularly used hash functions, including the widely deployed MD5 and SHA-1 algorithm. To assess this threat, the natural response has been to evaluate the extent to which various protocols actually depend on collision resistance for their security, and potentially schedule an upgrade to a stronger hash function. Other options involve altering the protocol in some way. This work suggests a different option. We present several simple message pre-processing techniques and show how the techniques can be combined with MD5 or SHA-1 so that applications are no longer vulnerable to the known collision attacks. For some applications, this may a viable alternative to upgrading the hash function.}
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @INPROCEEDINGS{Pramstaller2005ExploitingCodingTheory,
| |
| − | author = {Norbert Pramstaller and Christian Rechberger and Vincent Rijmen},
| |
| − | title = {Exploiting Coding Theory for Collision Attacks on SHA-1},
| |
| − | booktitle = {Cryptography and Coding 2005},
| |
| − | year = {2005},
| |
| − | editor = {Nigel P. Smart},
| |
| − | volume = {3796},
| |
| − | series = {LNCS},
| |
| − | pages = {78-95},
| |
| − | publisher = {Springer},
| |
| − | url = {http://dx.doi.org/10.1007/11586821_7},
| |
| − | abstract = {In this article we show that coding theory can be exploited efficiently for the cryptanalysis of hash functions. We will mainly focus on SHA-1. We present different linear codes that are used to find low-weight differences that lead to a collision. We extend existing approaches and include recent results in the cryptanalysis of hash functions. With our approach we are able to find differences with very low weight. Based on the weight of these differences we conjecture the complexity for a collision attack on the full SHA-1.}
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Pramstaller2005ImpactOfRotations,
| |
| − | author = {Norbert Pramstaller and Christian Rechberger and Vincent Rijmen},
| |
| − | title = {Impact of Rotations in SHA-1 and Related Hash Functions.},
| |
| − | booktitle = {SAC 2005},
| |
| − | year = {2006},
| |
| − | pages = {261-275},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {3897},
| |
| − | url = {http://dx.doi.org/10.1007/11693383_18},
| |
| − | abstract = {SHA-1 uses a single set of rotation constants within the compression function. However, most other members of the MD4 family of hash functions use multiple sets of rotation constants, MediaObjects/InlineFigure1.pngthe rotation amounts change with the step being processed. To our knowledge, no design rationales on the choice of rotation constants are given on any of these hash functions. This is the first paper that analyzes rotations in iterated hash functions. We focus on SHA-1-like hash functions and use recent developments in the analysis of these hash functions to evaluate the security implications of using multiple sets of rotation constants in the compression function instead of a single set. Additionally, we give some observations on the set of constants used in SHA-0 and SHA-1.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @MISC{Wang2005NewCollisionSearch,
| |
| − | author = {Xiaoyun Wang and Andrew Yao and Frances Yao},
| |
| − | title = {New Collision Search for SHA-1},
| |
| − | month = {August},
| |
| − | year = {2005},
| |
| − | howpublished = {Presented at rump session of CRYPTO 2005},
| |
| − | note = {Presented at rump session of CRYPTO 2005},
| |
| − | owner = {npramstaller},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @MISC{Wang2005CryptanalysisOfSHA1,
| |
| − | author = {Xiaoyun Wang and Andrew Yao and Frances Yao},
| |
| − | title = {Cryptanalysis of SHA-1},
| |
| − | howpublished = {Presented at the Cryptographic Hash Workshop hosted by NIST},
| |
| − | month = {October},
| |
| − | year = {2005},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @INPROCEEDINGS{Wang2005FindingCollisionsin,
| |
| − | author = {Xiaoyun Wang and Yiqun Lisa Yin and Hongbo Yu},
| |
| − | title = {Finding Collisions in the Full SHA-1},
| |
| − | booktitle = {Advances in Cryptology - CRYPTO 2005},
| |
| − | year = {2005},
| |
| − | editor = {Victor Shoup},
| |
| − | volume = {3621},
| |
| − | series = {LNCS},
| |
| − | pages = {17-36},
| |
| − | url = {http://dx.doi.org/10.1007/11535218_2},
| |
| − | publisher = {Springer},
| |
| − | abstract = {In this paper, we present new collision search attacks on the hash function SHA-1. We show that collisions of SHA-1 can be found with complexity less than 2<sup>69</sup> hash operations. This is the first attack on the full 80-step SHA-1 with complexity less than the 2<sup>80</sup> theoretical bound.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @INPROCEEDINGS{Rijmen2005UpdateonSHA-1,
| |
| − | author = {Vincent Rijmen and Elisabeth Oswald},
| |
| − | title = {Update on SHA-1},
| |
| − | booktitle = {CT-RSA 2005},
| |
| − | year = {2005},
| |
| − | editor = {Alfred Menezes},
| |
| − | volume = {3376},
| |
| − | series = {LNCS},
| |
| − | pages = {58-71},
| |
| − | publisher = {Springer},
| |
| − | url = {http://dx.doi.org/10.1007/b105222},
| |
| − | abstract = {We report on the experiments we performed in order to assess the security of SHA-1 against the attack by Chabaud and Joux [5]. We present some ideas for optimizations of the attack and some properties of the message expansion routine. Finally, we show that for a reduced version of SHA-1, with 53 rounds instead of 80, it is possible to find collisions in less than 2<sup>80</sup> operations.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @INPROCEEDINGS{Biham2005CollisionsofSHA-0,
| |
| − | author = {Eli Biham and Rafi Chen and Antoine hirose and Patrick Carribault and Christophe Lemuet and William Jalby},
| |
| − | title = {Collisions of SHA-0 and Reduced SHA-1},
| |
| − | booktitle = {Advances in Cryptology - EUROCRYPT 2005},
| |
| − | year = {2005},
| |
| − | editor = {Ronald Cramer},
| |
| − | volume = {3494},
| |
| − | series = {LNCS},
| |
| − | pages = {36-57},
| |
| − | publisher = {Springer},
| |
| − | url = {http://dx.doi.org/10.1007/11426639_3},
| |
| − | abstract = {In this paper we describe improvements to the techniques used to cryptanalyze SHA-0 and introduce the first results on SHA-1. The results include a generic multi-block technique that uses near-collisions in order to find collisions, and a four-block collision of SHA-0 found using this technique with complexity 2<sup>51</sup>. Then, extension of this and prior techniques are presented, that allow us to find collisions of reduced versions of SHA-1. We give collisions of variants with up to 40 rounds, and show the complexities of longer variants. These techniques show that collisions up to about 53-58 rounds can still be found faster than by birthday attacks.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Satoh2005HardwareArchitectureAnd,
| |
| − | author = {Akashi Satoh},
| |
| − | title = {Hardware Architecture and Cost Estimates for Breaking SHA-1.},
| |
| − | booktitle = {ISC 2005},
| |
| − | year = {2005},
| |
| − | pages = {259-273},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {3650},
| |
| − | url = {http://dx.doi.org/10.1007/11556992_19},
| |
| − | abstract = {The cryptanalysis of hash functions has advanced rapidly, and many hash functions have been broken one after another. The most popular hash function SHA-1 has not been broken yet, but the new collision search techniques proposed by Wang et al. reduced the computational complexity down to 2<sup>69</sup>, which is only 1/2,000 of the 2<sup>80</sup> operations needed for a birthday attack. The complexity is still too large even for today’s supercomputers, but no feasibility study of breaking SHA-1 using specialized hardware has been reported. The well known brute force attack on DES simply repeats the DES operation 2<sup>56</sup> times at a maximum, but the complexity of 2<sup>69</sup> hash operations to break SHA-1 does not mean 2<sup>69</sup> SHA-1 operations. Complex procedures using SHA-1 functions are required, and the total number of operations based on the probability of a collision occurrence is almost equivalent to the 2<sup>69</sup> SHA-1 operations. Therefore, we describe a procedure and propose an LSI architecture to find real collisions for SHA-1 in this paper. The hardware core was synthesized by using a 0.13-µm CMOS standard cell library, and its performances in speed, size, and power consumption were evaluated. A $10 million budget can build a custom hardware system that would consist of 303 personal computers with 16 circuit boards each, in which 32 SHA-1-breaking LSIs are mounted. Each LSI has 64 SHA-1 cores that can run in parallel. This system would find a real collision in 127 days.}
| |
| − | }
| |
| − | </bibtex>
| |
| | | | |
| | ---- | | ---- |
| Line 209: |
Line 24: |
| | === Others === | | === Others === |
| | | | |
| − | <bibtex>
| |
| − | @inproceedings{Saarinen2003CryptanalysisOfBlock,
| |
| − | author = {Markku-Juhani Olavi Saarinen},
| |
| − | title = {Cryptanalysis of Block Ciphers Based on SHA-1 and MD5.},
| |
| − | booktitle = {FSE 2003},
| |
| − | year = {2003},
| |
| − | pages = {36-44},
| |
| − | url = {http://springerlink.metapress.com/content/xu0qg98tg38gl7nf/?p=2664f1c23d3f433f9d3fd6a9a1350eda&pi=3},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {2887},
| |
| − | abstract = {We cryptanalyse some block cipher proposals that are based on dedicated hash functions SHA-1 and MD5. We discuss a related-key attack against SHACAL-1 and present a method for finding rdquoslid pairsrdquo for it. We also present simple attacks against MDC-MD5 and the Kaliski-Robshaw block cipher.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Handschuh2001AnalysisOfSHA-1,
| |
| − | author = {Helena Handschuh and Lars R. Knudsen and Matthew J. B. Robshaw},
| |
| − | title = {Analysis of SHA-1 in Encryption Mode.},
| |
| − | booktitle = {CT-RSA 2001},
| |
| − | year = {2001},
| |
| − | pages = {70-83},
| |
| − | url = {http://link.springer.de/link/service/series/0558/bibs/2020/20200070.htm},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {2020},
| |
| − | abstract = {This paper analyses the cryptographic hash function SHA-1 in encryption mode. A detailed analysis is given of the resistance of SHA-1 against the most powerful known attacks today. It is concluded that none of these attacks can be applied successfully in practice to SHA-1. Breaking SHA-1 in encryption mode requires either an unrealistic amount of computation time and known/chosen texts, or a major breakthrough in cryptanalysis. The original motivation for this analysis is to investigate a block cipher named SHACAL based on these principles. SHACAL has been submitted to the NESSIE call for cryptographic primitives.},
| |
| − | }
| |
| − | </bibtex>
| |
| − | ----
| |
| − |
| |
| − | == Performance Evaluation / Implementation (HW and SW) ==
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Lee2006,
| |
| − | author = {Yong Ki Lee and Herwin Chan and Ingrid Verbauwhede},
| |
| − | title = {Throughput Optimized SHA-1 Architecture Using Unfolding Transformation.},
| |
| − | booktitle = {ASAP 2006},
| |
| − | year = {2006},
| |
| − | pages = {354-359},
| |
| − | url = {http://doi.ieeecomputersociety.org/10.1109/ASAP.2006.68},
| |
| − | publisher = {IEEE Computer Society},
| |
| − | year = {2006},
| |
| − | abstract = {In this paper, we analyze the theoretical delay bound of the SHA-1 algorithm and propose architectures to achieve high throughput hardware implementations which approach this bound. According to the results of FPGA implementations, 3,541 Mbps with a pipeline and 893 Mbps without a pipeline were achieved. Moreover, synthesis results using 0.18..m CMOS technology showed that 10.4 Gbps with a pipeline and 3.1 Gbps without a pipeline can be achieved. These results are much faster than previously published results. The high throughputs are due to the unfolding transformation, which reduces the number of required cycles for one block hash. We reduced the required number of cycles to 12 cycles for a 512 bit block and showed that 12 cycles is the optimal in our design.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Chaves2006,
| |
| − | author = {Ricardo Chaves and Georgi Kuzmanov and Leonel Sousa and Stamatis Vassiliadis},
| |
| − | title = {Rescheduling for Optimized SHA-1 Calculation.},
| |
| − | booktitle = {SAMOS 2006},
| |
| − | year = {2006},
| |
| − | pages = {425-434},
| |
| − | url = {http://dx.doi.org/10.1007/11796435_43},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {4017},
| |
| − | abstract = {This paper proposes the rescheduling of the SHA-1 hash function operations on hardware implementations. The proposal is mapped on the Xilinx Virtex II Pro technology. The proposed rescheduling allows for a manipulation of the critical path in the SHA-1 function computation, facilitating the implementation of a more parallelized structure without an increase on the required hardware resources. Two cores have been developed, one that uses a constant initialization vector and a second one that allows for different Initialization Vectors (IV), in order to be used in HMAC and in the processing of fragmented messages. A hybrid software/hardware implementation is also proposed. Experimental results indicate a throughput of 1.4 Gbits/s requiring only 533 slices for a constant IV and 596 for an imputable IV. Comparisons to SHA-1 related art suggest improvements of the throughput/slice metric of 29% against the most recent commercial cores and 59% to the current academia proposals.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Michail2005OptimizingSHA-1Hash,
| |
| − | author = {H. E. Michail and A. P. Kakarountas and George N. Selimis and Costas E. Goutis},
| |
| − | title = {Optimizing SHA-1 Hash Function for High Throughput with a Partial Unrolling Study.},
| |
| − | booktitle = {PATMOS 2005},
| |
| − | year = {2005},
| |
| − | pages = {591-600},
| |
| − | url = {http://dx.doi.org/10.1007/11556930_60},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {3728},
| |
| − | abstract = {Hash functions are widely used in applications that call for data integrity and signature authentication at electronic transactions. A hash function is utilized in the security layer of every communication protocol. As time passes more sophisticated applications arise that address to more users-clients and thus demand for higher throughput. Furthermore, due to the tendency of the market to minimize devices’ size and increase their autonomy to make them portable, power issues have also to be considered. The existing SHA-1 Hash Function implementations (SHA-1 is common in many protocols e.g. IPSec) limit throughput to a maximum of 2 Gbps. In this paper, a new implementation comes to exceed this limit improving the throughput by 53%. Furthermore,power dissipation is kept low compared to previous works, in such way that the proposed implementation can be characterized as low-power.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Toma2005FormalVerificationOf,
| |
| − | author = {Diana Toma and Dominique Borrione},
| |
| − | title = {Formal Verification of a SHA-1 Circuit Core Using ACL2.},
| |
| − | booktitle = {TPHOLs 2005},
| |
| − | year = {2005},
| |
| − | pages = {326-341},
| |
| − | url = {http://dx.doi.org/10.1007/11541868_21},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {3603},
| |
| − | abstract ={Our study was part of a project aiming at the design and verification of a circuit for secure communications between a computer and a terminal smart card reader. A SHA-1 component is included in the circuit. SHA-1 is a cryptographic primive that produces, for any message, a 160 bit message digest. We formalize the standard specification in ACL2, then automatically produce the ACL2 model for the VHDL RTL design; finally, we prove the implementation compliant with the specification. We apply a stepwise approach that proves theorems about each computation step of the RTL design, using intermediate digest functions.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Jarvinen2005ACompactMD5,
| |
| − | author = {Kimmo U. J{\"a}rvinen and Matti Tommiska and Jorma Skytt{\"a}},
| |
| − | title = {A Compact MD5 and SHA-1 Co-Implementation Utilizing Algorithm Similarities.},
| |
| − | booktitle = {ERSA},
| |
| − | year = {2005},
| |
| − | pages = {48-54},
| |
| − | publisher = {CSREA Press},
| |
| − | year = {2005},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Lien2004A1Gbit/s,
| |
| − | author = {Roar Lien and Tim Grembowski and Kris Gaj},
| |
| − | title = {A 1 Gbit/s Partially Unrolled Architecture of Hash Functions SHA-1 and SHA-512.},
| |
| − | booktitle = {CT-RSA},
| |
| − | year = {2004},
| |
| − | pages = {324-338},
| |
| − | url = {http://dx.doi.org/10.1007/b95630},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {2964},
| |
| − | abstract = {Hash functions are among the most widespread cryptographic primitives, and are currently used in multiple cryptographic schemes and security protocols, such as IPSec and SSL. In this paper, we investigate a new hardware architecture for a family of dedicated hash functions, including American standards SHA-1 and SHA-512. Our architecture is based on unrolling several message digest steps and executing them in one clock cycle. This modification permits implementing majority of dedicated hash functions with the throughput exceeding 1 Gbit/s using medium-size Xilinx Virtex FPGAs. In particular, our new architecture has enabled us to speed up the implementation of SHA-1 compared to the basic iterative architecture from 544 Mbit/s to 1 Gbit/s using Xilinx XCV1000. The implementation of SHA-512 has been sped up from 717 to 929 Mbit/s for Virtex FPGAs, and exceeded 1 Gbit/s for Virtex-E Xilinx FPGAs.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Wang2004AnHMACProcessor,
| |
| − | author = {Mao-Yin Wang and Chih-Pin Su and Chih-Tsun Huang and Cheng-Wen Wu},
| |
| − | title = {An HMAC processor with integrated SHA-1 and MD5 algorithms.},
| |
| − | booktitle = {ASP-DAC},
| |
| − | year = {2004},
| |
| − | pages = {456-458},
| |
| − | url = {http://doi.acm.org/10.1145/1015090.1015204},
| |
| − | publisher = {IEEE},
| |
| − | abstract = {Cryptographic algorithms are prevalent and important in digital communications and storage, e.g., both SHA-1 and MD5 algorithms are widely used hash functions in IPSec and SSL for checking the data integrity. In this paper, we propose a hardware architecture for the standard HMAC function that supports both. Our HMAC design automatically generates the padding words and reuses the key for consecutive HMAC jobs that use the same key. We have also implemented the HMAC design in silicon. Compared with existing designs, our HMAC processor has lower hardware cost---12.5% by sharing of the SHA-1 and MD5 circuitry and a little performance penalty.},
| |
| − | }
| |
| − | </bibtex>
| |
| − |
| |
| − | <bibtex>
| |
| − | @inproceedings{Grembowski2002ComparativeAnalysisOf,
| |
| − | author = {Tim Grembowski and Roar Lien and Kris Gaj and Nghi Nguyen and Peter Bellows and Jaroslav Flidr and Tom Lehman and Brian Schott},
| |
| − | title = {Comparative Analysis of the Hardware Implementations of Hash Functions SHA-1 and SHA-512.},
| |
| − | booktitle = {ISC},
| |
| − | year = {2002},
| |
| − | pages = {75-89},
| |
| − | url = {http://link.springer.de/link/service/series/0558/bibs/2433/24330075.htm},
| |
| − | publisher = {Springer},
| |
| − | series = {LNCS},
| |
| − | volume = {2433},
| |
| − | abstract = {Hash functions are among the most widespread cryptographic primitives, and are currently used in multiple cryptographic schemes and security protocols such as IPSec and SSL. In this paper, we compare and contrast hardware implementations of the newly proposed draft hash standard SHA-512, and the old standard, SHA-1. In our implementation based on Xilinx Virtex FPGAs, the throughput of SHA-512 is equal to 670 Mbit/s, compared to 530 Mbit/s for SHA-1. Our analysis shows that the newly proposed hash standard is not only orders of magnitude more secure, but also significantly faster than the old standard. The basic iterative architectures of both hash functions are faster than the basic iterative architectures of symmetric-key ciphers with equivalent security.},
| |
| − | }
| |
| − | </bibtex>
| |
| | | | |
| | == eHash Recommendation (optional) or eHash Opinion == | | == eHash Recommendation (optional) or eHash Opinion == |
| | Something like: SHA-1 is considered to be broken. Please do not incorporate SHA-1 in new application any longer. Try to migrate to another hash function. | | Something like: SHA-1 is considered to be broken. Please do not incorporate SHA-1 in new application any longer. Try to migrate to another hash function. |
