![](bg7.png)
Table 1: Attack complexities. Memory is negligible.
Target Time Mode
hash 2
64
DM-PRESENT-80 (1)
comp 2
49.84
DM-DES (2)
comp 2
63.22
MMO-PRESENT-80 (1)
comp 2
63.22
MP-PRESENT-80 (1)
comp 2
63.22
H-PRESENT-128 (3)
comp 2
63.22
Tandem-DM (3)
comp 2
107
Tandem-DM (4)
comp 2
63.22
Abreast-DM (3)
comp 2
107
Abreast-DM (4)
hash 2
64
Parallel-DM (1)
comp 2
108.44
Parallel-DM (5)
H-PRESENT-128. We demonstrated non-random
properties of block ciphers also for compression
functions in MMO and MP modes. Our attacks
also included double-block-length hash modes such
as Tandem-DM, Hirose’s, Abreast-DM and Parallel-
DM. Attack complexities are listed in Table 1. Nota-
tion: (1) 21-round PRESENT-80, (2) 16-round DES,
(3) 21-round PRESENT-128, (4) 9-round Serpent-
256, (5) 9-round Serpent-128. Based on these results
we conclude that the DM and Parallel-DM modes
are the weakest concerning linear attacks. These re-
sults also show that the Merkle-Damg˚ard padding
scheme used in DM mode is not enough to counter
linear analysis, and thus avoid nonrandom detection
attacks. It is well known that, if the Merkle-Damg˚ard
padding scheme is used, collision-resistance in the
compression function propagates to the hash function
(I.B.Damg˚ard, 1989). On the other hand, our results
show that, in the case of linear attacks aimed at the
DM mode, the MD strengthening scheme was not ef-
fective to preclude nonrandom weaknesses to propa-
gate from the underlying block cipher to the full hash
function.
ACKNOWLEDGEMENTS
Research funded by INNOVIRIS, the Brussels Insti-
tute for Research and Innovation, under the ICT Im-
pulse program CRYPTASC.
REFERENCES
A.Bogdanov, Knudsen, L., Leander, G., Paar, C.,
Poschmann, A., Robshaw, M., Seurin, Y., and Vikkel-
soe, C. (2007). Present: an ultra-lightweight block
cipher. In 9th Int. Workshop on Cryptographic Hard-
ware and Enbedded Sysytems (CHES), LNCS 4727,
pages 450–466. Springer.
A.Bogdanov, Leander, G., Paar, C., Poschmann, A., Rob-
shaw, M., and Seurin, Y. (2008). Hash functions and
rfid tags: mind the gap. In CHES, LNCS 5154, pages
283–299. Springer.
Anderson, R., Biham, E., and Knudsen, L. (1998). Ser-
pent: a proposal for the advanced encryption standard.
NIST AES proposal.
C.Kaufman, Perlman, R., and Speciner, M. (2002). Net-
work Security: PRIVATE Communication in a PUB-
LIC World. Prentice-Hall.
E.Biham, Dunkelman, O., and Keller, N. (2002). Linear
cryptanalysis of reduced round serpent. In Fast Soft-
ware Encryption (FSE), LNCS 2355, pages 219–238.
Springer.
FIPS (1993). Data encryption standard. Federal Info. Proc.
Standards Pub. 46-2, supersedes FIPS PUB 46-1.
I.B.Damg˚ard (1989). A design principle for hash functions.
In Adv. in Cryptology, Crypto’89, LNCS 435, pages
416–427. Springer.
Lai, X. and Massey, J. (1993). Hash function based on
block ciphers. In Adv. in Cryptology, Eurocrypt’92,
LNCS 658, pages 55–70. Springer.
Matsui, M. (1994). The first experimental cryptanalysis of
the data encryption standard. In Adv. in Cryptology,
Crypto 1994, LNCS 839, pages 1–11. Springer.
Menezes, A., van Oorschot, P., and Vanstone, S. (1997).
Handbook of Applied Cryptography. CRC Press.
Merkle, R. (1989). One way hash functions and des. In Adv.
in Cryptology, Crypto’89, LNCS 435, pages 428–446.
Springer.
M.Matsui (1994). Linear cryptanalysis method for des ci-
pher. In Adv. in Cryptology, Eurocrypt’93, LNCS 765,
pages 386–397. Springer.
Nakahara.Jr, J., Sepehrdad, P., Zhang, B., and Wang, M.
(2009). Linear (hull) and algebraic cryptanalysis of
the block cipher present. In Cryptology and Net-
work Security, CANS 2009, LNCS 5888, pages 58–75.
Springer.
NIST (2007). Announcing request for candidate algo-
rithm nominations for a new cryptographic hash algo-
rithm (sha-3) family. Federal Register, vol.72, no.212,
Nov.2.
S.Hirose (2006). Some plausible constructions of double-
block length hash functions. In Fast Software Encryp-
tion, FSE, LNCS 4047, pages 210–225. Springer.
V.Rijmen, Preneel, B., and Win, E. D. (1997). On weak-
nesses of non-surjective round functions. Design,
Codes and Cryptography, 12(3):253–266.
W.Hohl, Lai, X., Meier, W., and Waldvogel, C. (1993). Se-
curity of iterated hash functions based on block ci-
phers. In Adv. in Cryptology, Crypto’93, LNCS 773,
pages 379–390. Springer.
Non-randomPropertiesofCompressionandHashFunctionsusingLinearCryptanalysis
477