Andrea Röck

Practical analysis of reduced-round keccak

Keccak is a finalist of the SHA-3 competition. In this paper we propose a practical distinguisher on 4 rounds of the hash function with the submission parameters. Recently, the designers of Keccak published several challenges on reduced versions of the hash function. With regard to this, we propose a preimage attack on 2 rounds, a collision attack on 2 rounds and a near collision on 3 rounds of

Cryptanalysis of Luffa v2 components

\lfloor

Stream ciphers using a random update function: study of the entropy of the inner state

Keccak

Cryptanalysis of ESSENCE

\rfloor_{224}

Generalization of Matsui's Algorithm 1 to linear hull for key-alternating block ciphers

and

Entropy of the Internal State of an FCSR in Galois Representation

\lfloor

Parallel Generation of l -Sequences

Keccak

The Linux Pseudorandom Number Generator Revisited

\rfloor_{256}

Exploiting Linear Hull in Matsui´s Algorithm 1

. These are the first practical cryptanalysis results on reduced rounds of the hash function scenario. All of our results have been implemented.

On Petri Nets and Predicate-Transition Nets.

We develop a number of techniques for the cryptanalysis of the SHA-3 candidate Luffa, and apply them to various Luffa components. These techniques include a new variant of the rebound approach taking into account the specifics of Luffa. The main improvements include the construction of good truncated differential paths, the search for differences using multiple inbound phases and a fast final solution search via linear systems. Using these techniques, we are able to construct nontrivial semi-free-start collisions for 7 (out of 8 rounds) of Luffa-256 with a complexity of 2104 in time and 2102 in memory. This is the first analysis of a Luffa component other that the permutation of Luffa v1. Additionally, we provide new and more efficient distinguishers also for the full permutation of Luffa v2. For this permutation distinguisher, we use a new model which applies first a short test on all samples and then a longer test on a smaller subset of the inputs. We demonstrate that a set of right pairs for the given differential path can be found significantly faster than for a random permutation.