Pushing the Limit of Memory-Efficient Collision Attack Framework for SHA-2 (Crypto 2026)

Hello. Hello everyone. My name is Yini from East China Normal University. Today I'm going to present our work pushing the limit of memory efficient clean clear the attack from from worker for shu. This is John Walker with fond and jal. Uh in this work we improve the practical and theoretical clear text on reduc reduced shu and in particular we obtained the first practical uh clear cle uh for 35 steps shadow. Uh we first briefly introduce a background cryptographic hashy function maps a message to affect the lens digit. Here we focus on the clear resistance. It should be hard to find to different message with message with the same harsh volume. SH is uh still one of the most important and v deployed hash function family. So studing it's it security m uh margin remains an important problem. uh SH mainly consists of 256 and uh in uh consists of SH 256 and SHA 512. uh SH one uh Shafi want to use uh 32bit words has um 164 steps and I produced produce 256 bit digit SH I want to use uh use a 64bit wars has 80 steps and produces 512bit digist For both versions, the compression function consists of two M types messages expansion and the stay up function. Stay update following the follow uh follow the the follow the B feed forward operation or take a target reduce steps uh present uh the compression function of SHU as shown in this figure at every steps at every step one expounded the message order wi together with the step constant and the current internal state is used to update the eight state words for our take. the in the interaction uh between the expanded message world and the internal and the internal state is especially important and in the message expansion the uh the original message block contains contains uh 16 message word after the first 16 words uh Every every new word wi is computed from four expounded message word use modular uh rotation and shift. SH 56 and SH 512 has a different rotation number. And the second physics is the update update step transformation. The internals data can be represent represent represented by two steps ei. Uh every step every step has a mod uh modular addition the blame function if and maj and the large sigma uh sigma function 256 and sh 512 has different rotation number and the sigma function. And next we will review previous clean attacks for SH 256 before this work. The best practical clear tech covered 31 steps for SH five for SH 512. The best practical clear tech cover uh 29 steps. There are uh there are still a large gap between clear tech clear attack and the sim free star clears. Uh therefore we want to further improve the clear text on shot two. Uh we use two block message. We use two we use our two block uh clear. We use a two block uh cleans the framework. The first block m0 uh determine determine determines the uh changing value CV1. Then we construct two different sect uh second blocks M1 M1 P such that after the radius sh compression function they produce a same hash volume uh to uh to uh to further increase the number of steps covered by the clean attack. We adopt the memory f center framework which which was proposed diet Asia crypto 2024. Um the framework contains three steps. The first steps is the pre-processing phases and the second steps is the matching physics. Uh in the M phys it uh it render generate the first message block zero and the firstly and uh the s and the firstly steps is uh is use the remaining message freedom to satisfy the condition in the later steps. Uh here is here is the previous application of this this framework to 31 step shot f6 use a clear cle attack framework described above it can uh easily achieve the practical clear attack on 31 steps sh 56. Uh next let's look uh we look at the factor that uh factors that affect the time complex in more details in the pro in the pro in the pre-processing phases uh it first use first use uh the first step is use the SAT solver to generate a uh generate a valid uh starting point in the middle of differential characteristic. Then we uh then the and then we extend each uh each starting point backward by uh in numerating message and stay variables such as W8 W8 E4 and W7 E3. This stage mainly affects the memory cost and the prempute uh premp uh pre premp compution time and is a matching physics we it generated we generated the random me zero computer CV1 and look for com compatible entry in keyboard 2. After the su successful margin some early condition can be check check it on the fly in this in this stage employ and beta determine the overall time complex and of the uh clean attack framework. So what factor what factors affect emperor and beta from the uh cle attack framework we can see that they mainly depend on the number of conditions in w 0 to w7 and the number of condition after uh st 16. Uh then the quest uh the question is how can we which is the message to reduce those condition uh while increasing the number of steps in shadow attack. Uh first we review the previous uh strategy for selecting message words for for 20 uh for 27 28 and 29 steps sh we can treat we can observe observe a very regular shift in the position of the non nonzero message word foram for example uh from 27 to uh from 20 uh from 27 to 28 steps. The active message word move forward by one steps by one step. This is suggests that the differential trail can be ve can be ve as three parts. T1, T0, T1 and T2. Here the T1 is inactive. T uh T0 is inactive. T1 is the active window counting all nonzero message difference and T2 is unactive. The important observation is that if we keep the struct and the length of the active window fixed changing changing shifts the low the local clear. However, different active uh window structure pro deals very different volume of embryo and the beta. Uh so not a very shift lead uh lead to leads to an effective clear uh clear attack. And next uh 41 is equal to uh 16. The chaos was first used at Asia Asia crypto uh 20 2011 to achieve a practical uh 32 steps semifree startling attack. Uh here we keep the length of t1 and t2 unchanged and u increase the length of t0 which give us 30 uh 33 steps local. However, with this message world difference pattern, we couldn't found we couldn't found a a valid differential tri for 31 steps. Another important strategies is the T1 is equal to uh 80 18. It was the previous it were previous uh pre uh previously used the tokons tracked a practical 39 step free stop attack since uh since shifting the ping down uh downward doesn't work. We try shift it upward instead by key by keeping uh t1 and t2 and change it and uh gradual gradually reduce reducing t0 we can get semif on uh 35 36 37 steps shot to uh uh similar uh similar is uh 21 is equal to 90. Uh 90 steps active window was already used in previous uh 39 steps seeming freestyle clear attacks. Again we shift this structure backward. Um by keeping T1 and T2 unchanged unchanged and the gradual reducing T0 we can obtain the semi free star uh clean attack on 35 36 37 and 39 st and [snorts] uh next we summarize the different message strong uh strongest showing in this table. From this table we can see uh we can see that both t1 is equal to n uh 17 and t1 is equal to 19 can uh effectively improve clear uh clear the text on shu. However, uh in order to select the most stable nonzero message words, we use the auto automated tool to uh search for differential trials the message function and the comparison. As we can see when uh vent t uh t1 is equal to 18. We can uh we construct two models to search for differential trail. One take all steps as the objective function. Well, the other takes only the part after the part after uh step uh 16 as the objective function. Venty is equal to 19. We use we use all steps as objective objective function. It it is easy to see that the set of nonzero message word for uh t1 is equal to 19 is most for clean attack. Using this uh new message order selection we search for differential trail for uh 35 steps SH 256 and we can be easily to search for 31 steps differential as showing this this table during uh during the search processing with struct we structly limit the number of conditions that affect the complexity of the clean attack providing the me basis for efficient message modification. The result is our name our first contribution. We obtained the first practical clean the attack on 35 steps shot to 56 compared with the previous best practical attack on 31 steps shot 25 to 56. This increases the number the number of attacked um steps by four step steps and uh with the same message word selection to SH 512. Um uh so Shopify want to has 40 uh SH one to has uh 604 bit words and differential rotation constant uh constant. So we need a different differential characteristic. The similar we search for uh 35 steps SH 512 different shell trail and showing this table and uh we can obtain the first practical clear tax on uh 35 set 512 uh the previous best practical clear tax cover only 29 steps. So in this so in the uh SH 512 case we improve the practical records by six steps from uh 29 to uh 35. Uh here we're showing the practical cleaning message here for both the 35 steps shot 56 and 35 steps shot 512. The red number indicate difference between M1 and M1 pre. And uh next the same idea can al uh can also be pushed uh further by shifting the select messageward by one or two position. We obtained the 30 36 steps uh step clear tax and obtained the uh 37 step of clear tax. And next we conclude our results with a blue the blue are our new practical clear tax. Uh we improve the shot 56 from the previous practical record of 31 steps to 35 steps and the shot 512 from 29 steps to 35 steps. The green are our new theoretical attacks for SH 256. We obtained the new complex CT for uh 36 and 37 steps for SH 512. We first obtained the 36 and 37 steps theoretical clear tax and there are the main reference uh related uh to pre clean tax and thank you very much for your attention. I'm I'm happy to take any question.