International Association for Cryptologic Research

International Association
for Cryptologic Research


Meet-in-the-Middle Preimage Attacks on Sponge-based Hashing

Lingyue Qin , Tsinghua University
Jialiang Hua , Tsinghua University
Xiaoyang Dong , Tsinghua University
Hailun Yan , School of Cryptology, University of Chinese Academy of Sciences
Xiaoyun Wang , Tsinghua University
DOI: 10.1007/978-3-031-30634-1_6 (login may be required)
Search ePrint
Search Google
Presentation: Slides
Conference: EUROCRYPT 2023
Abstract: The Meet-in-the-Middle (MitM) attack has been widely applied to preimage attacks on Merkle-Damgård (MD) hashing. In this paper, we introduce a generic framework of the MitM attack on sponge-based hashing. We find certain bit conditions can significantly reduce the diffusion of the unknown bits and lead to longer MITM characteristics. To find good or optimal configurations of MitM attacks, e.g., the bit conditions, the neutral sets, and the matching points, we introduce the bit-level MILP-based automatic tools on Keccak, Ascon and Xoodyak. To reduce the scale of bit-level models and make them solvable in reasonable time, a series of properties of the targeted hashing are considered in the modelling, such as the linear structure and CP-kernel for Keccak, the Boolean expression of Sbox for Ascon. Finally, we give an improved 4-round preimage attack on Keccak-512/SHA3, and break a nearly 10 years’ cryptanalysis record. We also give the first preimage attacks on 3-/4-round Ascon-XOF and 3-round Xoodyak-XOF.
  title={Meet-in-the-Middle Preimage Attacks on Sponge-based Hashing},
  author={Lingyue Qin and Jialiang Hua and Xiaoyang Dong and Hailun Yan and Xiaoyun Wang},