Length Extension Attack on Narrow-Pipe SHA-3 Candidates

Abstract

In this paper we show that narrow-pipe SHA-3 candidates BLAKE-32, BLAKE-64, Hamsi, SHAvite-3-256, SHAvite-3-512, Skein-256-256 and Skein-512-512 do not provide n bits of security where n is the hash output size. The actual security against length extension attack that these functions provide is n − k bits of security, where k is an arbitrary value chosen by the attacker who wants to perform one-time pre-computation of 2^k + 1 compression functions. The attack can be in two variants: 1. The attacker is not collecting the hash values given by the user or 2. The attacker is collecting the hash values given by the user. In any case, the attacker does not know the content of the hashed messages. The optimal value for this attack from the perspective of minimizing the number calls to the compression function and increasing the probability of the successful attack is achieved when k has a value $k=\frac{n}{2}$, thus reducing the security against the length-extension attack from n to $\frac{n}{2}$ bits.