A Collision Attack on a Double-Block-Length Compression Function Instantiated with Round-Reduced AES-256

Abstract

This paper presents the first non-trivial collision attack on the double-block-length compression function presented at FSE 2006 instantiated with round-reduced AES-256: $f_0(h_0\Vert h_1,M)\Vert f_1(h_0\Vert h_1,M)$ such that

$$\begin{aligned} f_0(h_0 \Vert h_1,M)&=E_{h_1\Vert M}(h_0)\oplus h_0 ,\\ f_1(h_0 \Vert h_1,M)&=E_{h_1\Vert M}(h_0\oplus c)\oplus h_0\oplus c , \end{aligned}$$

where $\Vert$ represents concatenation, $E$ is AES-256 and $c$ is a non-zero constant. The proposed attack is a free-start collision attack. It uses the rebound attack proposed by Mendel et al. It finds a collision with time complexity $2^{8}$, $2^{64}$ and $2^{120}$ for the instantiation with 6-round, 8-round and 9-round AES-256, respectively. The space complexity is negligible. The attack is effective against the instantiation with 6-/8-round AES-256 if the $16$-byte constant $c$ has a single non-zero byte. It is effective against the instantiation with 9-round AES-256 if the constant $c$ has four non-zero bytes at some specific positions.

A Example of Collision for \(f_0\) Instantiated with 6-Round AES-256

Table 2 gives an example of collision for $f_0$ instantiated with 6-round AES-256.

Table 2. An example of collision for $f_0$ instantiated with 6-round AES-256