Subject: [Cfrg] Who agree with building block cipher, hash, MAC with same round function and key schedulel

From: "duo lei" <[email-masked]>
Date: Wed, 2 Aug 2006 14:16:23 +0800

Dear all:

     In the paper http://eprint.iacr.org/2006/147, titled "New
Integrated proof Method on Iterated Hash Structure and New Structures
", the author give an integrated proof method on security proof of
iterated hash structure. Based on the proof method, one  can
distinguish the security of Merkel-Damag{\aa}rd structure, wide-pipe
hash, double-pipe hash and 3c hash, the paper also give a new recommend
structure.

At last, a new hash called F-hash, MAC called F-MAC and encryption
model Called FBC-mode are given,  based on same block cipher round
function and key schedule algorithm, which means with a same block
cipher round function and key schedule algorithm, we can have a Hash,
MAC and block cipher and Encryption Mode, the proof based knowledge of
that was based on security of Feistel structure. The AES with 256 bits
key and plaintext (called Rijndael) is good selection.

Who agree with the point of  considering using same round function and key
schedule
algorithm to build a block cipher, MAC and Hash.

best regards.
                       Duo Lei
_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 3 Aug 2006 11:33:00 -0400

Steve,

Excellent points, as usually. I caught myself chuckling involuntarily
while reading about the possible social aspects of GOST design. As for
the Americans - that was a chilling thought.

Getting back to hash - I'd be more comfortable with GOST-like hash
design, i.e. based on a real block cipher. And MACing using block cipher
(authenticated encryption, or something like GMAC).

-----Original Message-----
From: Steven M. Bellovin [mailto:[email-masked]] 
Sent: Thursday, August 03, 2006 10:48 AM
To: Blumenthal, Uri
Cc: [email-masked]
Subject: Re: [Cfrg] Who agree with building block cipher, hash, MAC with
same round function and key schedulel

On Wed, 2 Aug 2006 10:09:45 -0400, "Blumenthal, Uri"
<[email-masked]> wrote:

> This is what Russians have done. And from what I see, their old
> cryptographic school is like their ballet - without competition. :-)
>  
> Russian cryptographic suite (Encryption, MAC, Hash) is based on
> old-but-still-strong block cipher GOST 28147, and their Digital
> Signature standard is based on Elliptic Curve Crypto. 
>  
> Block cipher that Russians base their symmetric key (and keyless - aka
> hash) algorithms compares to AES in strengh. Its weaknesses are:
64-bit
> block size, and simplistic key schedule. The first weakness is due to
> algorithm's age (end of 70-ties?), the second one I suspect to be a
> design compromise. Designers sacrificed strong key schedule for
greater
> key agility. This becomes important when you build hash out of block
> cipher.
>  
> It is illustrative to observe how they approached hash design.
Americans
> took an idea of block cipher, figured that full strength is not needed
> and simplified the heck out of it - and then put together gazillion of
> rounds to compensate for the overly simplistic round function.
Russians
> took a real full-strength block cipher, and considering that full
> strength is not needed - truncated the number of rounds. So encrypting
> GOST is 32 rounds, while hashing GOST is "only" 16.
>  
There may also be some interesting social aspects to the design.  GOST
28147's variable S-boxes may make life harder for enemy cryptanalysts.
On
the other hand, specifying the S-box separately for each community of
interest makes it difficult to communicate securely outside of certain
authorized paths -- and that fact might have been of interest to, shall
we
say, certain parties...

As for the Americans -- remember how everyone marveled that SHA-0 was
structurally so similar to MD5?  Rivest got it right -- even the NSA
couldn't improve on his basic design.  Or was it that the design was
indeed good, so NSA didn't need to disclose one of its one designs?
After
all, look how much of their art open sector cryptographers had learned
from DES -- no point in making that mistake again...?

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Fri, 4 Aug 2006 11:23:40 -0400

Chosen key attack useful for what - determining the S-boxes?  How does
it affect hash security? I do not see the implication (besides a
convenient way of discovering your own S-boxes that for example were
given to you in a "sealed" equipment).
 
Regarding non-linearity of S-box space - it simply means that there are
good and bad S-boxes. And whoever is in charge of providing S-boxes
(KGB, in case of Soviet Union) can at will supply you with strong
S-boxes (so your communications would be secure), or with weak S-boxes
(so your communications could be cracked). Or that if you decided to
discard the S-boxes that "they" gave you and choose your own instead -
there is a chance that your variant of the algorithm will be breakable.

________________________________

	From: duo lei [mailto:[email-masked]] 
	Sent: Friday, August 04, 2006 10:42 AM
	To: Blumenthal, Uri
	Cc: [email-masked]
	Subject: Re: [Cfrg] Who agree with building block cipher, hash,
MAC with same round function and key schedulel

	On 8/3/06, Blumenthal, Uri <[email-masked]> wrote: 

		1. The idea of "chosen key attack" sounds rather
ridiculous to me,
		especially in a normal society. Consider "ability to
decrypt enemy 
		ciphertexts using chosen key attack" and improving that
to "known key
		attack". I can imagine societies when such techniques
could be useful -
		but hope that Third Reich is gone for good (probably I'm
overly 
		optimistic, but anyway this would turn a discussion away
from Crypto
		Research topic).

	In my understanding, when we use the block cipher algorithm to
build a hash, the chosen key attack become useful.  Since the key is
replaced by chaining value or message. It is possible for the attacker
to select some 'key' for attack. If the cipher is not immune aganist
selected key attack, it is hard to give proof of the hash is security.
To get over this problem, I try many ways to use the known proofs, but
failed. 

		2. An excellent point regarding non-permutation S-boxes.
In fact,
		"substitution block space" is NON-linear. There ARE bad
S-boxes. The 
		rumor is that KGB (who was in charge of providing
S-boxes) would decide
		how good an S-box set to give you!

	I am not very understanding this part, but when I compute the
conditional probability of known hash structure, I found that, if the
compression function is not a permutation, the probability distribution
of output may not be a uniformly distribution, so I think, the
permutation may be the better selection. Of cause that was dependent on
the condition.  

		3. There was a suggestion in Academia to use 8x8 S-boxes
instead of 4x4.
		The only problem with it is - where to get good S-boxes.
:-)