TIDAL: Practical Collisions on State-Reduced Keccak Variants

Abstract

An important tool that has contributed to collision search on Keccak /SHA3 is the Target Difference Algorithm (TDA) and its internal differential counterpart Target Internal Difference Algorithm (TIDA) which were introduced by Dinur et al. in separate works in FSE 2012 and 2013 respectively. These algorithms provide an ingenious way of extending the differential trails by one round and exploit the affine subspaces generated due to low algebraic degree of the Keccak S-box. The current work introduces TIDAL, which can extend TIDA by one more round capitalizing on linearization techniques introduced by Guo et al. in JoC. The TIDAL strategy in conjunction with a deterministic internal differential trail has been applied to Keccak variants up till 400-bit state-size and leads to practical collision attacks for most of them up to 5 rounds. In particular collisions have been confirmed for 4-round Keccak [136, 64] with a complexity of 220 and on 6-round of Keccak [84,16] with a complexity of 25. Further, this work provides a complete characterization of all collision attacks on state-reduced variants showcasing that TIDAL covers most of the space up till 5 rounds. As state and round-reduced Keccak variants are used to realize internal states of many crypto primitives, the results presented here generate significant impact. Finally, it shows new directions for the long standing problem of state-reduced variants being difficult to be attacked.