Improved Indifferentiable Security Analysis of PHOTON

Abstract

In this paper, we study the indifferentiable security of the domain extension algorithm of the PHOTON hash function that was proven to be indifferentiable from a random oracle up to $\mathcal{O}(2^{\min\{ c/2, c^\prime/2 \}})$ query complexity, where c is the capacity in the absorbing step of PHOTON and c ^′ is that in the squeezing step. By reducing the size c ^′, one can reduce the processing time spent by PHOTON, while the indifferentiable security is degraded. Note that there is no generic attack on PHOTON with $\mathcal{O}(2^{c^\prime/2})$ query complexity. Thus it is interesting to investigate the optimality of the indifferentiable security and the size of c ^′ ensuring the $\mathcal{O}(2^{c/2})$ security.

For these motivations, first, we prove that PHOTON is indifferentiable from a random oracle up to $\mathcal{O}(\min \{ q_{\mathsf{mcoll}} (d^\ast,c-c^\prime ), 2^{c/2} \})$ query complexity where q _mcoll (d ^∗,c − c ^′) is the query complexity to find a d ^∗-multi-collision of (c − c ^′) bits of hash values and d ^∗ satisfies $q_{\mathsf{mcoll}} (d^\ast,c-c^\prime ) = 2^{c^\prime }/d^\ast$. We also show that there exists a generic attack on PHOTON with the same query complexity. Thus the indifferentiable security of our proof is optimal.

Second, by using this bound we study the parameter c ^′ ensuring the $\mathcal{O}(2^{c/2})$ security. We show that the $\mathcal{O}(2^{c/2})$ security is ensured if c ^′ ≥ c/2 + log₂ c, which implies that we can reduce the processing time by PHOTON with keeping the same indifferentiable security.

Finally, we propose a faster construction than PHOTON with keeping the same indifferentiable security, where the length of the first message block is modified from r bits to r + c/2 bits.