Subject: RE: [Cfrg] Who agree with building block cipher, hash, MAC with same round function and key schedulel

From: "Blumenthal, Uri" <[email-masked]>
Date: Wed, 2 Aug 2006 18:46:02 -0400

>>...GOST uses 256-bit key (and has always been this way).
>> It doesn't accept 128-bit or 192-bit keys.
>
> Length (of key) isn't everything. As someone pointed out,
> block size does matter.

Small (by today's standards) block size of GOST 28147 was mentioned in
my original post as one of weaknesses (compared to 20-years more modern
designs that were under specific request of 128-bit block size) for
obvious reasons. How many times does this horse have to be beaten?

>> Not mentioning that S-boxes were supposed to be secret (giving
>> extra 512 bits).
>
> This is bogus. It's a secret that can be reverse engineered out of 
> any device or software implementation, and has to be given out to 
> anyone who needs to implement it. I don't believe this counts.

A) Strength of GOST algorithm does NOT depend on the secrecy of the
S-boxes. Some S-boxes (for GOST hash and for Russian Central Bank -
which happen to be the same :-) have been published. So no big deal if
they leak, or are otherwise known. Try to analyze it - and see for
yourself. (I did, and I did. Back in 1996.) 

B) In practice, trying to attack REMOTE communications - when you can't
open your own cell phone and pry information from its SIM card (or when
the specs are not public and you weren't selected to be an implementor)
- you will have sweet time figuring the unknown S-boxes out. Not that it
is impossible - but it's yet another tall fence to climb over. And after
you get those S-boxes, you're still stuck with breaking 256-bit key.

>-----Original Message-----
>   GOST takes a 64 bit key. A device was built for less than $1 million
>that cracks DES using brute force in less than a day. So why couldn't
>a similar one crack GOST in 256 days (or less given Moore's law)? I
>find it hard to believe that a piece of hardware can be built for less
>that $1 million that could crack AES in that amount of time.
>
>   Can you expound on your statement that GOST "compares to AES in
>strength".
>
>>  This is what Russians have done. And from what I see, their old
>>  cryptographic school is like their ballet - without competition. :-)
>>
>>  Russian cryptographic suite (Encryption, MAC, Hash) is based on
>>  old-but-still-strong block cipher GOST 28147, and their Digital
>>  Signature standard is based on Elliptic Curve Crypto.
>>
>>  Block cipher that Russians base their symmetric key (and keyless -
aka
>>  hash) algorithms compares to AES in strengh. Its weaknesses are:
>64-bit
>>  block size, and simplistic key schedule. The first weakness is due
to
>>  algorithm's age (end of 70-ties?), the second one I suspect to be a
>>  design compromise. Designers sacrificed strong key schedule for
>greater
>>  key agility. This becomes important when you build hash out of block
>>  cipher.
>>
>>  It is illustrative to observe how they approached hash design.
>Americans
>>  took an idea of block cipher, figured that full strength is not
needed
>>  and simplified the heck out of it - and then put together gazillion
of
>>  rounds to compensate for the overly simplistic round function.
>Russians
>>  took a real full-strength block cipher, and considering that full
>>  strength is not needed - truncated the number of rounds. So
encrypting
>>  GOST is 32 rounds, while hashing GOST is "only" 16.
>>
>>
>>
>>  ________________________________
>>
>>	From: duo lei [mailto:[email-masked]]
>>	Sent: Wednesday, August 02, 2006 2:16 AM
>>	To: [email-masked]
>>	Subject: [Cfrg] Who agree with building block cipher, hash,MAC
>>  with same round function and key schedulel
>>
>>
>>	Dear all:
>>
>>	     In the paper http://eprint.iacr.org/2006/147, titled "New
>>	Integrated proof Method on Iterated Hash Structure and New
>>  Structures
>>	", the author give an integrated proof method on security proof
>>  of
>>	iterated hash structure. Based on the proof method, one  can
>>	distinguish the security of Merkel-Damag{\aa}rd structure,
>>  wide-pipe
>>	hash, double-pipe hash and 3c hash, the paper also give a new
>>  recommend
>>	structure.
>>
>>	At last, a new hash called F-hash, MAC called F-MAC and
>>  encryption
>>	model Called FBC-mode are given,  based on same block cipher
>>  round
>>	function and key schedule algorithm, which means with a same
>>  block
>>	cipher round function and key schedule algorithm, we can have a
>>  Hash,
>>	MAC and block cipher and Encryption Mode, the proof based
>>  knowledge of
>>	that was based on security of Feistel structure. The AES with
>>  256 bits
>>	key and plaintext (called Rijndael) is good selection.
>>
>>
>>
>>	Who agree with the point of  considering using same round
>>  function and key schedule
>>	algorithm to build a block cipher, MAC and Hash.
>  >
>>	best regards.
>>	                       Duo Lei
>>
>>
>>
>>  _______________________________________________
>>  Cfrg mailing list
>>  [email-masked]
>>  https://www1.ietf.org/mailman/listinfo/cfrg
>>
>
>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/cfrg

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: Jack Lloyd <[email-masked]>
Date: Thu, 3 Aug 2006 00:10:38 -0400

> you get those S-boxes, you're still stuck with breaking 256-bit key.

2^32 encryptions under a single chosen key - I wouldn't really
consider that a much of a 'tall fence', especially in comparison to a
256-bit keysearch. See "A chosen key attack against the secret S-boxes
of GOST", Markku-Juhani Saarinen.

I would personally be skeptical of using GOST Sboxes that were not
permutations, which would mean there is significantly less than 2^512
possible (good) choices. But that is just a quibble, I suppose, as the
naive search space would still be quite large with those possibilities
removed from consideration.

Jack