对缩减轮数SM3散列函数改进的原像与伪碰撞攻击  

Improved preimage and pseudo-collision attacks on SM3 hash function

作　　者：邹剑[1,2] 董乐 

机构地区：[1]福州大学数学与计算机科学学院,福建福州350108 [2]福州大学网络系统信息安全重点实验室,福建福州350108 [3]河南师范大学大数据统计分析与优化控制河南工程实验室,河南新乡453007

出　　处：《通信学报》2018年第1期46-55,共10页Journal on Communications

基　　金：福建省中青年教师教育科研基金资助项目(No.JAT170097);福州大学科研启动基金资助项目(No.510150)~~

摘　　要：提出了对SM3散列函数32轮的原像攻击和33轮的伪碰撞攻击。利用差分中间相遇攻击与biclique技术改进了对SM3的原像分析结果,将攻击结果从之前的30轮提高到了32轮。基于上述方法,通过扩展32轮原像攻击中的差分路径,对SM3构造了33轮的伪碰撞攻击。以2^(254.5)的时间复杂度与25的空间复杂度构造了对SM3的32轮原像攻击,并以2^(126.7)的时间复杂度与23的空间复杂度构造了对SM3的33轮伪碰撞攻击。A preimage attack on 32-step SM3 hash function and a pseudo-collision attack on 33-step SM3 hash function respectively were shown. 32-step preimage attack was based on the differential meet-in-the-middle and biclique technique, while the previously known best preimage attack on SM3 was only 30-step. The 33-step pseudo-collision attack was con-structed by using the same techniques. The preimage attack on 32-step SM3 can be computed with a complexity of 2254.5, and a memory of 25. Furthermore, The pseudo-preimage and pseudo-collision attacks on 33-step SM3 by extending the differential characteristic of the 32-step preimage attack were present. The pseudo-collision attack on 33-step SM3 can be computed with a complexity of 2126.7, and a memory of 23.

关 键 词：SM3散列函数 原像攻击 伪碰撞攻击 差分中间相遇攻击 BICLIQUE 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]