Analysis of LAKE - Cryptanalysis and design of symmetric primitives

The input of the compression function of LAKE is the previous chaining value h

l−1

,

further referred as PSA1, finds two different chaining values h

_{and h}

_{and two}

different block indexes t

_{and t}

_{such that:}

compr ess(h

, M , S, t

) = compress(h

, M , S, t

),

(7.1)

for some message block M and salt S. Notice that there are no differences in the

message words. The salt can be chosen freely.

Our second attacks, further referred as PSA2, finds two different chaining val-

ues h

and h

such that:

t runc

(compress(h

, M , S, t)) = trunc

(compress(h

, M , S, t)),

(7.2)

where t runc

(x) is function that returns the last 224 bits of x (truncation to the

right) and M , S, t are some values. Hence, the second attack finds a near pseudo

collisions for the compression function with differences only in the first word of the

output. In a truncated version, like LAKE-224, this would mean a collision

_.

The rest of the analysis has the following outline. First, we will point out some

properties of the non-linear functions used in LAKE. Using these properties we will

launch the first pseudo collision attack PSA1 for the middle building block of the

compression function, theprocessmessagefunction, and then we will extend the

attack to thesaltstateandfeedforwardfunctions as well. Further, we will find the

solutions for the equations we get in the meantime, and we will estimate the total

complexity of the attack. In a similar way as the first attack PSA1, we will present

the second pseudo collision attack PSA2.

7.2.1 Simple Observations

From the design of LAKE, few simple observations follow. These observations are

directly used in the attacks of the compression function.

Observation 1 Function f(x, y, z, t) is non-injective by the first three arguments

x, y, z.

For example, for x there exist different values x

₁

,x

₂

such that f(x

₁

, y, z, t) =

f(x

₂

, y, z, t) for some y, z, t. The same property holds for y and z.

This observation was mentioned by Lucks at FSE’08. Mendel and Schläffer

independently found and used this property to successfully attack four out of eight

rounds of LAKE-256. Non-injectivity of the function f can be used to cancel a

difference in one of the first three arguments of f , when the rest of the arguments

are properly fixed.

Observation 2 There is some non-symmetry when updating the state variables.

It is important to notice when the internal variables are updated one by one, by

the functions f and g, there are no temporary variables that store their previous

values. This is supposedly done in order to increase the diffusion. Yet, it leads to

some rather non-symmetrical situations. For example, when L

is being updated by

the function f , its new value depends, particularly, of the new value of the previous

variable L

i−1

. In other words, first L

i−1

is computed, and then this value is used

to calculate the new value of L

. But, when L

is updated by the function f , it

depends on the "old" value of L

₁₅

, because L

₁₅

is updated last. Same holds when

the function g is used as an updating function. When L

is being updated by the

function g, its value depends, particularly, on the new value of previous variable

L

_i₋₁

and the old value of the next variable L

i+1

. But, when L

is updated, it takes

the new value of the next variable, which is L

. This implies that the first and the

last variables are updated according to slightly different rules.

7.2.2 PSA1 onProcessmessageProcedure

First, let us try to attack only the middle procedure of the compression function,

i.e.

processmessage

function. It consists of 8 rounds (10 rounds for LAKE-512).

In every round, first all of the 16 internal variables are updated by the function f ,

and then all of them are updated by the function g.

Let T

be the updated, by the function f , value of the variable L

.

Let N

be the updated, by the function g, value of the variable T

(or same as up-

dated value of L

by both f and g).

Our attack strategy is the following (Fig. 7.3):

1. Let only L

contain some specially chosen non-zero difference.

2. After the application of the function f we require zero differences in all the

variables except T

.

3. After the application of the function g we require zero differences in all the

variables.

Let us show that this scenario is possible. First let us prove that step 2 is achiev-

able. Considering that T

= f (T

i−1

, L

, M

, C

) we get that in T

a difference can be

introduced only through T

i−1

and L

(message words do not have differences (7.1),

C

are simply constants).

For∆T

we require non-zero difference:

∆T

= f (L

, L

, M

, C

) − f (L

, L

, M

, C

) 6= 0

(7.3)

Although in observation 1 we mentioned that the function f is non-injective by the

second argument, it is still easy to find different values for L

that lead to different

values for f . The first argument of f is not T

but L

(as mentioned in the

observation 2).

For∆T

we require zero difference:

0 0 0 0 0 ∆1 0 0 0 0 0 0 0 0 0 0 f f f f f f f f f f f f f f f f 0 0 0 0 0 ∆2 0 0 0 0 0 0 0 0 0 0 g g g g g g g g g g g g g g g g 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

Figure 7.2: Differences in the variables for the PSA1 on

processmessage. The

zero differences coming from M

and C

, as well as zero differences coming from

F

(i > 0) are not shown.

By observation 1 it follows that it is possible to get zero for∆T

.

For all other variables we require zero difference:

∆T

= f (T

i−1

, L

, M

, C

) − f (T

i−1

, L

, M

, C

) = 0

Note that all the variables are the same, there are no differences in T

, thus these

equations trivially hold.

Now, let us take a look at step 3. Again, considering that N

= g(N

i−1

, T

, L

, T

i+1

),

we get that in N

a difference can be introduced by any of N

i−1

, T

, L

and T

i+1

.

For∆N

we require zero difference, so we get:

∆N

= g(T

, T

, L

, T

) − g(T

, T

, L

, T

) = 0

(7.5)

Note that there are differences in two variables, T

₀

and L

₀

, and even though g is

an invertible function, it is still possible to solve this equation.

For the indexes i= 1..14 we get:

∆N

= g(N

i−1

, T

, L

, T

i+1

) − g(N

i−1

, T

, L

, T

i+1

) = 0

(7.6)

All the equations hold because there are no difference in any of the arguments.

For N

₁₅

we get:

∆N

= g(N

, T

, L

, N

) − g(N

, T

, L

, N

) = 0

Notice that the last argument is not T

but rather N

. This is where the observa-

tion 2 is applied. Non-symmetry allows us to get that this equation also holds if the

previous equations hold.

So, after only one round we can obtain an internal state with all-zero differ-

ences in the variables. But then, all the following rounds can not introduce any dif-

ference because there are zero differences in the internal state variables and zero

differences in the message words (7.1). So, if we are able to solve the equations

that we got then this means that the attack is applicable to any number of rounds,

i.e. increasing the number of rounds does not improve the security ofprocessmessage

function of LAKE.

Now let us take a closer look at the equations that we got.

Equation (7.3) can be rewritten as:

∆T

= f (L

, L

, M

, C

) − f (L

, L

, M

, C

) =

= (L

∨ C

) − (L

∨ C

) + [L

+ (M

⊕ C

)] 13 − [L

+ (M

⊕ C

)] 13

Here and further we will use that(A+ B) r = (A r)+(B r) with probability

around

1₄

(same holds when shift to the left is used). Therefore the above equation

can be rewritten as:

∆T

= (L

∨ C

) − (L

∨ C

) + L

13 − L

13 (7.7)

Equation (7.4) can be written as:

∆T

=f (T

, L

, M

, C

) − f (T

, L

, M

, C

) =

=T

2 0

− T

1 0

+ [M

+ (T

∧ C

)] 7 − [M

+ (T

∧ C

)] 7 =

=T

2 0

− T

1 0

+ (T

2 0

∧ C

) 7 − (T

∧ C

) 7 = 0

Equation (7.5) can be written as:

∆N

=g(T

, T

, L

2 0

, T

) − g(T

, T

, L

1 0

, T

) =

=[(T

+ T

) 1g] ⊕ (L

2 0

+ T

) − [(T

+ T

) ≫ 1] ⊕ (L

1 0

+ T

) = 0

The details of solving these equations are presented in Section 7.2.4.

7.2.3 PSA1 for the Full Compression Function

The designers of LAKE specifically stated that any attack on LAKE should be on the

whole design and not on the separate parts of the compression function. This way

the good properties of the HAIFA design are brought to the forefront. Therefore let

us try to attack the whole design. So far, if we assume that we can solve the previous

equations, we can get a pseudo-collision attack onprocessmessagefunction. Let us

try to extend the attack to the whole compression function. First, let us deal with

the initialization (functionsaltstate).

From the initialization of LAKE it can be seen that the variables H

through H

are straightforward copied into L

through L

. The variable L

depends on H

and

t

₀

. Similarly, L

depends on H

and t

. The rest of the variables do not depend

on the t

or t

. Again, we can see some additional non-symmetry apart from the

already mentioned in the observation 2. Since we need a difference in L

(for the

previous attack onprocessmessage

function), we will introduce difference in H

₀

.

Further we can follow our previous attack on the

processmessageblock and get

a collisions after theprocessmessagefunction. The only difficulty is how to deal

with L

₈

since it does depend on H

₀

which now has a non-zero difference. To our

help comes the block index t

₀

. By introducing a difference in t

₀

we can cancel the

difference from H

₀

in L

₈

. So we get the following equation:

∆L

= g(H

, S

⊕ t

, C

, 0) − g(H

, S

⊕ t

, C

, 0) =

= ((H

+ (S

⊕ t

)) ≫ 1 ⊕ C

) − ((H

+ (S

⊕ t

)) ≫ 1 ⊕ C

) = 0

Let ˜t

2₀

= t

2₀

⊕S

and ˜t

= t

⊕S

. Then, the above equation gets the following form:

∆L

= H

− H

1 0

+ ˜t

− ˜t

= 0

Now, let us deal with the last building block of the compression function, the final-

ization (feedforward). We keep in mind that we have differences only in H

₀

and

t

₀

. If we take a glance at the

feedforwardprocedure, we can see that H

₀

and t

₀

can be found in the same equation, and only there, which defines the new value

for H

₀

. Since, we require zero difference in all of the output variables, we get the

following equation:

∆H

= f (L

, L

, H

, S

⊕ t

) − f (L

, L

, H

, S

⊕ t

) =

= ˜t

2 0

7 − ˜t

1 0

7 + ( ˜t

2 0

⊕ H

2 0

) 13 − ( ˜t

1 0

⊕ H

1 0

) 13 = 0

This concludes our attack. We have shown that if we introduce a difference only in

the chaining value H

₀

and the block index t

₀

, it is possible to reduce the problem

of finding pseudo collisions for the compression function to the problem of solving

a system of equations.

7.2.4 Solution of the System of Equations

To find a pseudo collision for the full compression function of LAKE, we have to

solve the equations that were mentioned in the previous sections. As a result, we

get the following system:

T

₀2

− T

+ (T

2 0

∧ C

) 7 − (T

∧ C

) 7 = 0

(7.8)

T

₀2

− T

1 0

= (H

2 0

∨ C

) − (H

∨ C

) + H

13 − H

1 0

13 (7.9)

[(T

+ T

) 1] ⊕ (H

2 0

+ T

) − [(T

+ T

) 1] ⊕ (H

1 0

+ T

) = 0

(7.10)

H

₀2

_{− H}

₀1

+ ˜t

2 0

− ˜t

= 0

(7.11)

˜

t

2 0

7 − ˜t

7 + ( ˜t

⊕ H

2 0

) 13 − ( ˜t

⊕ H

1 0

) 13 = 0

(7.12)

Let us analyze (7.8). By fixing T

− T

= R, this equation can be rewritten as:

R+ [(T

₀1

+ R) ∧ C

₁

] 7 − (T

₀1

∧ C

) 7 = 0

(7.13)

If we rotate everything to the left by 7 bits we get:

[(T

0 0 0 0 0 ∆1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ∆0 0 0 0 g g g g g g g g 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 f f f f f f f f . . . . saltstate pro cessmessage feedforw ard H H L L 0 ∆t0 t

Figure 7.3: Differences in the variables for PSA1 on the full compression function.

The zero differences coming from M

and C

, as well as zero differences coming

from F

(i > 0) are not pictured.

As a result, we get an equation of the following form:

(X + A) ∧ C = X ∧ C + B

(7.15)

where X= T

, A= R, B = (−R) 7, C = C

.

Now, let us analyze (7.9). Again, let us fix T

₀2

− T

= R and H

2 0

− H

= D. Then

(7.9) gets the following form:

R= ((H

₀1

+ D) ∨ C

₀

) − (H

₀1

∨ C

) + D 13

(7.16)

This equation can be rewritten as:

where X_{= H}

, A= D, B = R − (D 13), C = C

.

In (7.10), if we regroup the components, we get:

[(T

+ T

) ⊕ (T

+ T

)] ≫ 1 = (H

+ T

) ⊕ (H

+ T

)

Then, the above equation is of the following form:

((X + A) ⊕ X ) ≫ 1 = (Y + B) ⊕ Y,

(7.18)

where X= T

+ T

, A= T

2 0

− T

1 0

, Y

= T

+ H

, B= H

2 0

− H

1 0

.

Now, let us analyze (7.11) and (7.12). Let us fix H

₀2

− H

= D. Note that then

from (7.11) we have ˜t

2₀

_{− ˜}t

₀1

= −D. If we rotate everything by 13 bits to the left in

(7.12) we get:

(−D) 6 + ( ˜t

2 0

⊕ H

2 0

) − ( ˜t

⊕ H

1 0

) = 0

(7.19)

˜

t

1₀

= [( ˜t

2₀

⊕ H

) − D 6] ⊕ H

1 0

(7.20)

If we put this expression for ˜t

1₀

in (7.11) we get:

D+ ˜t

₀2

− [( ˜t

2₀

⊕ H

2 0

) − D 6] ⊕ H

= 0

(7.21)

˜

t

2₀

= [( ˜t

₀2

⊕ H

) − D 6] ⊕ H

1 0

− D

(7.22)

If we XOR the value of H

₀2

to the both sides:

˜

t

2₀

_{⊕ H}

₀2

= ([( ˜t

₀2

_{⊕ H}

2₀

) − D 6] ⊕ H

1₀

_{− D) ⊕ H}

₀2

(7.23)

Let us denote ˜t

2₀

⊕ H

2 0

= X . Then we get:

X= [(X − D 6) ⊕ H

₀1

− D] ⊕ H

2 0

(7.24)

X_{⊕ H}

₀2

= (X − D 6) ⊕ H

₀1

_{− D}

(7.25)

Finally, we get an equation of the following form:

(X ⊕ K

) + A = (X + B) ⊕ K

(7.26)

where K

₁

= H

, A= R, B = −R 6, K

= H

.

There exist efficient algorithms (we call them Al1,Al2,Al3,Al4) for finding so-

lutions for equations of type (7.15),(7.17),(7.18),(7.26). In the following lemmas

we prove there existence.

Lemma 1 There exist an algorithm (Al1) for finding all the solutions for the equation

Lemma 2 There exist an algorithm (Al2) for finding all the solutions for the equation

of type (7.17). The complexity of Al2 depends only on the constant C.

Proof. The proofs for the two facts are very similar with some minor changes, so

we will prove only Lemma 1.

Let X= x

. . . x

x

, A= a

. . . a

a

, B= b

. . . b

b

, C= c

. . . c

c

. Then for each

iwe have:

(x

∧ c

) ⊕ a

⊕ t

= (x

⊕ b

⊕ r

) ∧ c

,

(7.27)

where t

= m(x

i−1

∧c

i−1

, a

i−1

, t

i−1

) is the carry at the (i−1)th position of (X ∧C+A),

r

= m(x

i−1

, b

i−1

, r

i−1

) is the carry at the (i−1)th position of X +B, and m(x, y, z) =

x y⊕ xz ⊕ yz.

The equation (7.27), when c

= 0, gets the following form:

a

⊕ t

= 0.

(7.28)

When c

= 1, we get:

a

_{⊕ t}

= b

_{⊕ r}

(7.29)

Let us assume that we found the values for t

and r

for some i. We find the smallest

j> 0 such that c

i+j

= 0. Then from (7.28) and the definition of t

we get:

a

i+j

=t

i+j

= m(x

i+j−1

, a

i+j−1

, t

i+j−1

) =

=m(x

i+j−1

, a

i+j−1

, m(x

i+j−2

, a

i+j−2

, t

i+j−2

)) = . . .

=m(x

i+j−1

, a

i+j−1

, m(x

i+j−2

, a

i+j−2

, m(. . . , m(x

, a

, t

)) . . .))

In the above equation, only x

, x

i+1

, . . . x

i+j−1

are unknown. So we can try all the

possibilities, which are 2

_{, and find all the solutions. Let us denote by ˜}_X

_{the set of}

all solutions.

Now, let us find the smallest l> 0 such that c

i+j+l

= 1. Notice that we can easily

find t

i+j+1

if considering c

i+j+l0

= 0 for l

∈ (0, l) and using (7.28):

t

i+j+1

=m(0, a

i+j

, t

i+j

) = m(0, a

i+j

, a

i+j

) = a

i+j

t

i+j+2

=m(0, a

i+j+1

, t

i+j+1

) = m(0, t

i+j+1

, t

i+j+1

) = m(0, a

i+j

, a

i+j

) = a

i+j

. . .

t

_i_+j+l

=m(0, a

_i_+j+l−1

, t

i+j+l−1

) = a

i+j

From (7.29) and definition of r

we get:

a

_i_+j+l

_{⊕ t}

_i_+j+l

_{⊕ b}

_i_+j+l

= r

_i_+j+l

= m(x

_i_+j+l−1

, b

i+j+l−1

, r

i+j+l−1

) =

=m(x

i+j+l−1

, b

i+j+l−1

, m(x

i+j+l−2

, b

i+j+l−2

, r

i+j+l−2

)) = . . .

In the above equation, only x

, x

i+1

, . . . , x

i+j+l−1

are unknown. Hence we check

all the possibilities by taking(x

, x

i+1

, . . . , x

i+j−1

) from the set ˜X and the rest of

the variables take all the possible values. If the equation has a solution, then this

means we have fixed another t

i+j+l

, r

i+j+l

, and we can continue searching using

the same algorithm.

The complexity of the algorithms is 2

_{, where q is size of the longest consecutive se-}

quence of ones followed by consecutive zero sequence (in the case above q= j + l)

in the constant C. Taking into consideration the value of the constant C

used in

the compression function of LAKE-256, we get that complexity of our algorithm for

this special case is 2

. Yet, the average complexity can be decreased additionally if

first the necessary conditions are checked. For example, if we have two consecutive

zeros in the constant C

₁

at positions i and i_{+ 1 then it has to hold a}

i+1

= a

. If

we check for all zeros, then only with probability of 2

−10

_{a constant A can pass this}

sieve. Therefore, the math expectancy of the complexity for a random A is less than

2 _.

Note that when∨ function is used instead of ∧, than 0 and 1 change place. There-

fore, our algorithm has a complexity of 2

_{when C}

is used as a constant. Yet, same

as for∧, early break-up strategies significantly decrease these complexities for the

case when solution does not exist. Again, the average complexity is less than 2

_.

Lemma 3 There exist an algorithm (Al3) for finding a solution for the following

equation:

((X + A) ⊕ X ) 1 = (Y + B) ⊕ Y

(7.30)

Proof. Instead of finding a solution with respect to X and Y we split (7.30) into a

system:

(X + A) ⊕ X = −1

(7.31)

(Y + B) ⊕ Y = −1

(7.32)

We can do this because the value of−1 is invariant of any rotation. We may loose

some solutions, but further we will prove that if such a solution exist then our al-

gorithm will find it with probability 2

−2

_.

We will analyze only (7.31); obviously the second equation can be solved analo-

gously.

Let X= x

₃₁

. . . x

₁

x

₀

, A= a

₃₁

. . . a

₁

a

₀

. Then for ith bit we get:

(x

⊕ a

⊕ c

) ⊕ x

= 1,

where c

is the carry at

(i − 1) position of X + A, i.e. c

= m(x

i−1

, a

i−1

, c

i−1

).

Obviously, the above equation can be rewritten as:

a

= c

_{⊕ 1}

(7.33)

For the(i + 1)th bit we get:

a

i+1

=c

i+1

⊕ 1 = m(x

, a

, c

) ⊕ 1 = m(x

, a

⊕ 1) ⊕ 1 =

(7.34)

=x

a

⊕ x

(a

⊕ 1) ⊕ a

(a

⊕ 1) ⊕ 1 =

(7.35)

So, we can easily find the value of x

for each i. When i= 31, x

can be any. For

the case when i= 0, considering that c

₀

= 0, from (7.33) we get:

a

₀

= 1

Therefore, if a

₀

= 1 then (7.31) is solvable in constant time. The solutions are

X= A 1+i2

_{, i}_{= 0, 1. Finally, for the whole system, we have that solution exist}

if a

= b

= 1, which means with probability 2

−2

.

Lemma 4 There exists an algorithm (Al4) for finding all the solutions for equations

of the following type:

(X ⊕ C) + A = (X + B) ⊕ K

(7.37)

Proof.

We base our algorithm fully on the results of

[115]. There, Paul and

Preneel show, in particular, how to solve equations of the form:

(x + y) ⊕ ((x ⊕ α) + (y ⊕ β)) = γ.

Let us XOR to the both sides of (7.37) A⊕ B ⊕ C and denote ˜K= K ⊕ A ⊕ B ⊕ C.

Then, the equation gets the following form:

((X ⊕ C) + A) ⊕ A ⊕ B ⊕ C = (X + B) ⊕ ˜K.

For the(i + 1)th bit position, we have:

˜k

i+1

= s

i+1

⊕ t

i+1

,

where s

is the carry at the ith position of(X ⊕ C) + A, and t

is the carry at ith

position of X+ B. From the definition of s

we get:

s

i+1

=(x

⊕ c

)a

⊕ (x

⊕ c

)s

⊕ a

s

=

=(x

⊕ c

)a

⊕ (x

⊕ c

⊕ a

)s

=

=(x

⊕ c

)a

⊕ (x

⊕ c

⊕ a

)(˜k

⊕ t

)

From the definition of t

we get:

t

i+1

= x

b

⊕ x

t

⊕ b

t

This means that ˜k

i+1

can be computed from x

,a

,b

,c

,t

, and ˜k

.

Further, we apply the algorithm demonstrated in

_{[115]. The only difference is}

that for each bit position we have only two unknowns x

and t

, whereas in[115]

have three unknowns. Yet, this difference is not crucial, and the algorithm can be

applied.

Our experimental results (Monte-Carlo with 2

_{trials), show that the probability}

Now, we can present our algorithm for finding solutions for the system of equa-

tions. With Al1 we find a difference R (and values for T

, T

) such that equation

(7.8) holds. Actually, for the same difference R many different solutions (T

1 0

, T

)

exist (experimental results show that when (7.8) is solvable then there are around

2 _{solutions). Then, we pass as an input to Al2 the difference R and we find a}

difference D (and values for H

, H

) such that (7.9) holds. Again for a fixed R

and D many (H

1₀

, H

2₀

) exist. Experimentally for each random R and "good" D there

are around 2

solutions. Using Al3 we check if we can find solutions for (7.10),

i.e. we try to find T

and T

. Notice, the input of Al3 are the previously found

T

₀1

, T

₀2

, H

₀1

, H

₀2

. If Al3 can not find a solution then we get another pair H

₀1

, H

₀2

(or

generate first new difference D and then generate another 2

pairs H

₀1

, H

₀2

). If Al3

finds a solution to (7.10), then with Al4 we try to find solutions for (7.11),(7.12)

where the input to Al4 are already found H

₀1

, H

₀2

. If Al4 can not find a solution,

then we can take different pair H

₀1

, H

₀2

(or generate first new difference D and then

generate H

, H

) and then apply first Al3 and then Al4.

7.2.5 Complexity of PSA1

Let us try to find the total complexity of the algorithm. We keep in mind that

when analyzing the initial equations we have used the assumption(A + B) r =

(A r) + (B r), which holds with probability

(see[46]). In total, we used this

assumption 5 times. In the equation for∆T

we can control the exact value of M

,

so in total we have used the assumption 4 times. Therefore the probability that a

solution of the system is a solution for the initial equations is 2

−8

. This means that

we have to generate 2

solutions for the system. Let us find the cost for a single

solution.

The average complexity for both Al1 and Al2 is 2

steps. We confirmed ex-

perimentally that, for a random difference R, there exists a solution for Equation

(7.8) with the probability 2

−27

_{. So this takes 2}

_{· 2}

_{= 2}

_{steps using Al1 and it}

finds 2

_{solutions for Equation (7.8). Similarly, for a random difference D, there is}

a solution for Equation (7.9) with the probability 2

−27

_{. Therefore, this consumes}

2 _{· 2}

_{= 2}

_{steps and finds 2}

_pairs_(H

, H

) for Equation (7.9). The probability

that a pair is a good pair for Equation (7.10) is 2

−1

and that it is a good pair for

Equations (7.11) and (7.12) is 2

−12

. Thus, we need 2

_{· 2}

_{= 2}

_{pairs, which}

we can be generated in 2

_{· 2}

_{= 2}

_{steps. Since we need 2}

_{solutions, the total}

complexity is 2

. Note that this complexity estimate (a step) is measured by the

number of calls to the algorithms that solve our specific equations. If we assume

that a call to the algorithms is four times less efficient than the call to the functions

f

or g (which on average seems to be the case), and consider the fact that the

compression function makes a total of around 2

calls to the functions f or g, then

we get that the total complexity of the collision search is around 2

compression

function calls.

Notice that when a solution for the system exists, then this still does not mean

that we have a pseudo collision. This is partially because we cannot control some

of the values directly. Indeed we can control directly only H

, H

, t

. The rest of

the variables, i.e. T

with the input variables H

, where i> 0. Since we pass these values as arguments

for the non-injective function f we may experience situation when we can not get

the exact value that we need. Yet, with overwhelming probability we can find the

exact values. Let us suppose we have a solution (H

, H

, T

, t

) for

the system of equations. First we find a message word M

₀

such that f(L

₁₅

, H

, M

, C

) =

T

. Notice that L

can be previously fixed by choosing some value for H

. Then

f(L

₁₅

, H

₀2

, M

, C

) = T

. We choose M

such that[M

+ (T

∧ C

)] 7 − [M

+

(T

∧ C

)] 7 = (T

∧ C

) 7 − (T

∧ C

) 7. This way the probability the

previous identity becomes 1. Then we find H

such that f(T

, H

, M

, C

) = T

. At

last, we find M

such that f(T

, L

, M

, C

) = T

. If such M

does not exist,

then we can change the value of T

by changing M

and then try to find M

. An

example of a colliding pair found with PSA1 is given in Tbl. 7.1.

Table 7.1: Colliding pairs for the compression function of LAKE found with PSA1.

63809228

6cc286da

00000000

00000540

h0₀

ba3f5d77

6cc286da

00000000

00000540

55e07658

00000009

00000000

00000002

5c41ab0e

0265e384

00000000

aba71835

00000000

79725351

e61a903f

730aace9

756be78a

b679b09d

de58951b

f5162345

14113165

7.2.6 PSA2 onProcessmessageProcedure

In PSA2 we introduce difference only in the chaining value H

₀

. Hence, this differ-

ence after thesaltstate

procedure, will produce differences in L

₀

and L

₈

. In the

first application of theprocessmessageprocedure the following differential is used