Cryptanalysis of the LANE hash function

Abstract

The LANE[4] hash function is designed by Sebastiaan Indesteege and Bart Preneel. It is now a first round candidate of NIST's SHA-3 competition. The LANE hash function contains four concrete designs with different digest length of 224, 256, 384 and 512. The LANE hash function uses two permutations P and Q, which consist of different number of AES[1]-like rounds. LANE-224/256 uses 6-round P and 3-round Q. LANE-384/512 uses 8-round P and 4-round Q. We will use LANE-n-(a,b) to denote a variant of LANE with a-round P, b-round Q and a digest length n. We have found a semi-free start collision attack on reduced-round LANE-256-(3,3) with complexity of 262 compression function evaluations and 269 memory. This technique can be applied to LANE-512-(3,4) to get a semi-free start collision attack with the same complexity of 262 and 269 memory. We also propose a collision attack on LANE-512-(3,4) with complexity of 294 and 2 133 memory. © 2009 Springer-Verlag Berlin Heidelberg.