Rebound Distinguishers: Results on the Full Whirlpool Compression Function

Mario Lamberger; Florian Mendel; Christian Rechberger; Vincent Rijmen; Martin Schläffer

doi:10.1007/978-3-642-10366-7_8

Rebound Distinguishers: Results on the Full Whirlpool Compression Function

Mario Lamberger, Florian Mendel, Christian Rechberger, Vincent Rijmen, Martin Schläffer

Institute of Applied Information Processing and Communications (7050)

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Abstract

Whirlpool is a hash function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full compression function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the compression function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round compression function of Whirlpool. This is the first result on the full Whirlpool compression function.

Original language	English
Title of host publication	Advances in Cryptology - ASIACRYPT 2009
Subtitle of host publication	15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, December 6-10, 2009, Proceedings
Place of Publication	Berlin; Heidelberg
Publisher	Springer
Pages	126-143
ISBN (Print)	978-3-642-10365-0
DOIs	https://doi.org/10.1007/978-3-642-10366-7_8
Publication status	Published - 2009
Event	15th International Conference on the Theory and Application of Cryptology and Information Security: ASIACRYPT 2009 - Tokyo, Japan Duration: 6 Dec 2009 → 10 Dec 2009

Publication series

Name	Lecture Notes in Computer Science
Volume	5912

Conference

Conference	15th International Conference on the Theory and Application of Cryptology and Information Security
Abbreviated title	ASIACRYPT 2009
Country/Territory	Japan
City	Tokyo
Period	6/12/09 → 10/12/09

Fields of Expertise

Information, Communication & Computing

Access to Document

10.1007/978-3-642-10366-7_8

EU - ECRYPT II - European network of excellence in cryptology - Phase II
Schmidt, J., Nad, T., Kirschbaum, M., Feldhofer, M., Schläffer, M., Aigner, M. J., Rechberger, C., Lamberger, M., Tillich, S., Medwed, M., Hutter, M., Rijmen, V., Mendel, F. & Posch, R.
1/08/08 → 31/01/13
Project: Research project
Cryptography
Schläffer, M. (Co-Investigator (CoI)), Oswald, M. E. (Co-Investigator (CoI)), Lipp, P. (Co-Investigator (CoI)), Dobraunig, C. E. (Co-Investigator (CoI)), Mendel, F. (Co-Investigator (CoI)), Eichlseder, M. (Co-Investigator (CoI)), Nad, T. (Co-Investigator (CoI)), Posch, R. (Co-Investigator (CoI)), Lamberger, M. (Co-Investigator (CoI)), Rijmen, V. (Co-Investigator (CoI)) & Rechberger, C. (Co-Investigator (CoI))
1/01/95 → 31/01/19
Project: Research area

Cite this

Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., & Schläffer, M. (2009). Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In Advances in Cryptology - ASIACRYPT 2009: 15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, December 6-10, 2009, Proceedings (pp. 126-143). (Lecture Notes in Computer Science; Vol. 5912). Springer. https://doi.org/10.1007/978-3-642-10366-7_8

Rebound Distinguishers: Results on the Full Whirlpool Compression Function. / Lamberger, Mario; Mendel, Florian; Rechberger, Christian et al.
Advances in Cryptology - ASIACRYPT 2009: 15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, December 6-10, 2009, Proceedings. Berlin; Heidelberg: Springer, 2009. p. 126-143 (Lecture Notes in Computer Science; Vol. 5912).

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Lamberger, M, Mendel, F, Rechberger, C, Rijmen, V & Schläffer, M 2009, Rebound Distinguishers: Results on the Full Whirlpool Compression Function. in Advances in Cryptology - ASIACRYPT 2009: 15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, December 6-10, 2009, Proceedings. Lecture Notes in Computer Science, vol. 5912, Springer, Berlin; Heidelberg, pp. 126-143, 15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, 6/12/09. https://doi.org/10.1007/978-3-642-10366-7_8

Lamberger M, Mendel F, Rechberger C, Rijmen V, Schläffer M. Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In Advances in Cryptology - ASIACRYPT 2009: 15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, December 6-10, 2009, Proceedings. Berlin; Heidelberg: Springer. 2009. p. 126-143. (Lecture Notes in Computer Science). doi: 10.1007/978-3-642-10366-7_8

Lamberger, Mario ; Mendel, Florian ; Rechberger, Christian et al. / Rebound Distinguishers: Results on the Full Whirlpool Compression Function. Advances in Cryptology - ASIACRYPT 2009: 15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, December 6-10, 2009, Proceedings. Berlin; Heidelberg : Springer, 2009. pp. 126-143 (Lecture Notes in Computer Science).

@inproceedings{50eebb9ff41c4ee584879d7038897f30,

title = "Rebound Distinguishers: Results on the Full Whirlpool Compression Function",

abstract = "Whirlpool is a hash function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full compression function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the compression function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round compression function of Whirlpool. This is the first result on the full Whirlpool compression function.",

author = "Mario Lamberger and Florian Mendel and Christian Rechberger and Vincent Rijmen and Martin Schl{\"a}ffer",

year = "2009",

doi = "10.1007/978-3-642-10366-7_8",

language = "English",

isbn = "978-3-642-10365-0",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "126--143",

booktitle = "Advances in Cryptology - ASIACRYPT 2009",

note = "15th International Conference on the Theory and Application of Cryptology and Information Security : ASIACRYPT 2009, ASIACRYPT 2009 ; Conference date: 06-12-2009 Through 10-12-2009",

}

TY - GEN

T1 - Rebound Distinguishers: Results on the Full Whirlpool Compression Function

AU - Lamberger, Mario

AU - Mendel, Florian

AU - Rechberger, Christian

AU - Rijmen, Vincent

AU - Schläffer, Martin

PY - 2009

Y1 - 2009

N2 - Whirlpool is a hash function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full compression function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the compression function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round compression function of Whirlpool. This is the first result on the full Whirlpool compression function.

AB - Whirlpool is a hash function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full compression function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the compression function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round compression function of Whirlpool. This is the first result on the full Whirlpool compression function.

U2 - 10.1007/978-3-642-10366-7_8

DO - 10.1007/978-3-642-10366-7_8

M3 - Conference paper

SN - 978-3-642-10365-0

T3 - Lecture Notes in Computer Science

SP - 126

EP - 143

BT - Advances in Cryptology - ASIACRYPT 2009

PB - Springer

CY - Berlin; Heidelberg

T2 - 15th International Conference on the Theory and Application of Cryptology and Information Security

Y2 - 6 December 2009 through 10 December 2009

ER -

Rebound Distinguishers: Results on the Full Whirlpool Compression Function

Abstract

Publication series

Conference

Fields of Expertise

Access to Document

Fingerprint

Projects

EU - ECRYPT II - European network of excellence in cryptology - Phase II

Cryptography

Cite this