The slides of my Defcon talk

1. SHA-3 vs the world
David Wong

2. Snefru
MD2
MD4
MD5
RIPEMD
HAVAL-128
SHA-0
SHA-1
RIPEMD-160
SHA-2
1992
1994
1990 1994
1991
1996
20041995
1999
1997
2004
2012
2007
2003
2016
2001 2003
2003
2003
http://valerieaurora.org/hash.html

5. KeccakBLAKE, Grøstl, JH, Skein

6. f
permutation-based cryptography
Sponge Construction

7. f
0
0
Sponge Construction
r
c

8. f
message
0
0
⊕
Sponge Construction

9. f
message
0
0
⊕ ⊕
Sponge Construction

10. f
message
0
0
⊕ ⊕
f
Sponge Construction

11. f
message
0
0
⊕ ⊕
f
⊕
Sponge Construction

12. f
message
0
0
⊕ ⊕
f
⊕
f
Sponge Construction

13. f
message
⊕ ⊕
f
⊕
f
absorbing
Sponge Construction
0
0

14. f
message
⊕ ⊕
f
⊕
f
absorbing
output
Sponge Construction
0
0

15. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f
Sponge Construction
0
0

16. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f
Sponge Construction
0
0

17. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f f
Sponge Construction
0
0

18. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f f
squeezing
Sponge Construction
0
0

19. f
message
⊕ ⊕
absorbing
output
f f
squeezing
Sponge Construction
24 rounds in SHA-3
0
0

21. Keccak
Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche

22. SHA-3 competition
2012
2007

23. SHA-3 competition
2012
2007
BLAKE2

31. SHA-3 competition
2012
2007
BLAKE2
SHA-3 standard (FIPS 202) 2015

32. github.com/gvanas/KeccakCodePackage

35. • bit security of AES-128?
• bit security of AES-256?
• bit security against pre-image attacks of SHA-256?
• bit security against pre-image attacks of SHA-512?
• bit security against pre-image attacks of SHA-3-512?
Bit Security

36. Where is SHA-3 being used?

38. SHAKE is a XOF

39. keccak.noekeon.org/tune.html

41. SHA-3 competition
2012
2007
BLAKE2
SHA-3 standard (FIPS 202) 2015
SP 800-185 2016

42. KMAC
TupleHash
ParallelHash

43. KMAC
TupleHash
ParallelHash
message || SHA-256(message)

44. KMAC
TupleHash
ParallelHash
message || SHA-256(key||message)

45. KMAC
TupleHash
ParallelHash
message || more || SHA-256(key||message||more)

46. KMAC
TupleHash
ParallelHash
message || SHAKE(key || message)

47. KMAC
TupleHash
ParallelHash
message || SHAKE(key || message)
my RSA public key = (e, N)

48. KMAC
TupleHash
ParallelHash
message || SHAKE(key || message)
my RSA public key = (e, N)
fingerprint = SHA-256(e || N)

49. KMAC
TupleHash
ParallelHash
message || SHAKE(key || message)
fingerprint1 = SHA-256(1010110000000010001…)
e N

50. KMAC
TupleHash
ParallelHash
message || SHAKE(key || message)
fingerprint1 = SHA-256(1010110000000010001…)
e N
fingerprint2 = SHA-256(1010110000000010001…)
e N

51. KMAC
TupleHash
ParallelHash
message || SHAKE(key || message)
SHAKE(len(e) || e || len(N) || N)

52. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f f
squeezing
Sponge Construction
0
0

53. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f f
squeezing
Sponge Construction
0
0

54. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f f
squeezing
Sponge Construction
0
0

55. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f f
squeezing
Sponge Construction
0
0

56. KMAC
TupleHash
ParallelHash
message || SHAKE(key || message)
SHAKE(len(e) || e || len(N) || N)
SHAKE(SHAKE(b1) || SHAKE(b2) || SHAKE(b3) || …)

57. SHA-3 competition
2012
2007
BLAKE2
SHA-3 / SHAKE 2015
TupleHash / ParallelHash / KMAC 2016

58. Keyak and Ketje

59. SHA-3 competition
2012
2007
BLAKE2
SHA-3 / SHAKE 2015
TupleHash / ParallelHash / KMAC 2016
KangarooTwelve
& MarsupilamiFourteen

61. SHA-3 competition
2012
2007
BLAKE2
SHA-3 / SHAKE 2015
TupleHash / ParallelHash / KMAC 2016
KangarooTwelve
& MarsupilamiFourteen

62. github.com/gvanas/KeccakCodePackage

63. Part II: Strobe

64. f
message
⊕ ⊕
f
⊕
f
absorbing
output
f f
squeezing
Sponge Construction
0
0

65. f
input
⊕
init
output
duplexing
Duplex Construction
f
input
⊕
output
duplexing
f
input output
duplexing
⊕0
0

66. myProtocol = Strobe_init(“myWebsite.com”)
myProtocol.KEY(sharedSecret)
buffer += myProtocol.send_ENC(“GET /”)
buffer += myProtocol.send_MAC(len=16)
// send the buffer
// receive a ciphertext
message = myProtocol.recv_ENC(ciphertext[:-16])
ok = myProtocol.recv_MAC(ciphertext[-16:])
if !ok {
// reset the connection
}
Symmetric Protocol

68. default
state = input ⊕ state
cbefore
state = input
cafter
output, state = input ⊕ state
forceF
the permutation is ran before the operation
internal operations

69. operation = KEY
⊕

70. f
operation = KEY
⊕

71. f
operation = KEY
data = 010100…
⊕

72. f
operation = KEY operation = send_ENC
⊕
f
data = 010100…
⊕
data = hello
⊕
ciphertext

73. data = 010100…
⊕
operation = AD
⊕

74. data = 010100…
operation = send_MAC
f
⊕ ⊕
len = 16
tag
operation = AD
⊕

75. data = 010100…
⊕
operation = send_CLR
⊕

76. data = 010100…
operation = RATCHET
f
⊕ ⊕
operation = send_CLR
⊕
data = 00000

77. myHash = Strobe_init(“hash”)
myHash.AD(“something to be hashed”)
hash = myHash.PRF(outputLen=16)
Hash Function

78. KDF = Strobe_init(“deriving keys”)
KDF.KEY(keyExchangeOutput)
keys = KDF.PRF(outputLen=32)
key1 = keys[:16]
key2 = keys[16:]
Key Derivation Function

79. strobe.sourceforge.io

80. Part III: Disco?

81. github.com/mimoo/NoiseGo/disco/specification.md
Noise + Strobe = Disco

82. Where to find me
cryptologie.net
twitter.com/lyon01_david