[Paper Review] HF-hash : Hash Functions Using Restricted HFE Challenge-1

Dhananjoy Dey, P. R. Mishra+1 more|arXiv (Cornell University)|Sep 8, 2009

Cryptographic Implementations and Security22 references3 citations

TL;DR

HF-hash is a novel cryptographic hash function that uses a restricted version of the HFE Challenge-1 multivariate polynomial system—specifically, the first 32 of 64 polynomials—with 16 variables fixed to zero—to construct a 256-bit digest. It achieves SHA-256-level efficiency and resists known differential attacks, including those by Chabaud and Joux and Wang et al., due to the complexity of the underlying multivariate system and its design choices in compression and message expansion.

ABSTRACT

Vulnerability of dedicated hash functions to various attacks has made the task of designing hash function much more challenging. This provides us a strong motivation to design a new cryptographic hash function viz. HF-hash. This is a hash function, whose compression function is designed by using first 32 polynomials of HFE Challenge-1 with 64 variables by forcing remaining 16 variables as zero. HF-hash gives 256 bits message digest and is as efficient as SHA-256. It is secure against the differential attack proposed by Chabaud and Joux as well as by Wang et. al. applied to SHA-0 and SHA-1.

Motivation & Objective

• To design a new cryptographic hash function resistant to known differential attacks on MD4, MD5, SHA-0, and SHA-1.
• To explore the feasibility of using multivariate quadratic polynomials from the HFE Challenge-1 as a basis for a secure compression function.
• To ensure the resulting hash function maintains high efficiency comparable to SHA-256 while offering strong resistance to collision and differential attacks.
• To provide a complete specification and analysis of HF-hash, including padding, parsing, initial values, and compression function design.

Proposed method

• The compression function is constructed from the first 32 multivariate quadratic polynomials of the HFE Challenge-1 system, with 16 variables set to zero, reducing a 64-variable system to 64 variables but using only 32 equations.
• The message is padded by appending a '1' bit, followed by zeros, and then the 64-bit length of the original message, satisfying the condition l + 1 + k + 64 ≡ 0 mod 448.
• The padded message is parsed into 448-bit blocks (14 words of 32 bits each), which are processed iteratively using the compression function.
• The initial value is derived from the fractional part of π, using its hexadecimal representation to generate 8 words (256 bits) for the initial state.
• The compression function applies the 32 multivariate polynomials over GF(2) to the current state and message block, updating the internal state using a feed-forward mechanism.
• The final hash value is obtained after processing all message blocks, with the final state output as the 256-bit digest.

Experimental results

Research questions

• RQ1 Can a restricted subset of the HFE Challenge-1 multivariate polynomial system be used to construct a secure and efficient cryptographic hash function?
• RQ2 Does the use of only 32 of 64 polynomials from HFE Challenge-1 preserve sufficient nonlinearity and resistance to differential cryptanalysis?
• RQ3 How does HF-hash compare in security and performance to SHA-256 and other MD-family or SHA-family hash functions?
• RQ4 Can the structural weaknesses observed in MD4, MD5, SHA-0, and SHA-1 be avoided by using a fundamentally different compression function based on multivariate polynomials?
• RQ5 Is the message expansion and compression design in HF-hash sufficient to prevent known differential patterns used in attacks on SHA-0 and SHA-1?

Key findings

• HF-hash produces a 256-bit message digest using a compression function based on the first 32 polynomials of HFE Challenge-1 with 16 variables set to zero, ensuring a compact and efficient design.
• The hash function is as efficient as SHA-256, making it suitable for practical deployment in systems requiring high-speed hashing.
• HF-hash is secure against the differential attack proposed by Chabaud and Joux on SHA-0, which required 2^61 evaluations, due to the high complexity of the underlying multivariate system.
• It resists the advanced differential patterns used by Wang et al. in attacks on SHA-1, as the message expansion and compression structure in HF-hash do not allow the same level of control over state transitions.
• The use of a fixed set of 32 multivariate quadratic polynomials over GF(2) introduces sufficient nonlinearity and resistance to algebraic and differential cryptanalysis.
• The design avoids the structural weaknesses of MD4 and SHA-1 families by replacing their iterative, bit-level operations with a more complex algebraic structure based on polynomial systems.