<p>This paper provides improved preimage attack results on round-reduced Keccak-384/512. Keccak is the winner of SHA-3 competition and it contains four main variants: Keccak-224, Keccak-256, Keccak-384 and Keccak-512. Different from short-output variants, Keccak-384/512 outputs from two parts of its state: the entire 320-bit first plane and a 64/192-bit truncation of the second plane. Due to lack of degrees of freedom, most existing preimage analysis can only control the first 320-bit plane and thus achieve limited results. By thoroughly analyzing the algebraic structure of Keccak, this paper proposes a technique named “extra linear dependence”, which can construct linear relations between corresponding bits in two planes. To apply such technique, this paper inherits pioneers’ attack thoughts that convert output bits to linear or quadratic equations of input variables. When solving the final equation system, those linear relations can lead to extra restricting equations of output, exceeding the limit of matrix rank. As a result, the complexities of preimage attacks on 2-round and 3-round Keccak-384/512 can be decreased to <InlineEquation ID="IEq1"> <EquationSource Format="TEX">$2^{39}$</EquationSource> <EquationSource Format="MATHML"><math> <msup> <mn>2</mn> <mn>39</mn> </msup> </math></EquationSource> </InlineEquation>/<InlineEquation ID="IEq2"> <EquationSource Format="TEX">$2^{204}$</EquationSource> <EquationSource Format="MATHML"><math> <msup> <mn>2</mn> <mn>204</mn> </msup> </math></EquationSource> </InlineEquation> and <InlineEquation ID="IEq3"> <EquationSource Format="TEX">$2^{270}$</EquationSource> <EquationSource Format="MATHML"><math> <msup> <mn>2</mn> <mn>270</mn> </msup> </math></EquationSource> </InlineEquation>/<InlineEquation ID="IEq4"> <EquationSource Format="TEX">$2^{424}$</EquationSource> <EquationSource Format="MATHML"><math> <msup> <mn>2</mn> <mn>424</mn> </msup> </math></EquationSource> </InlineEquation> Keccak calls respectively, which are all the best known results so far. To support the theoretical analysis, this paper provides the first preimage of all ‘0’ digest for 2-round Keccak-384, which can be obtained in several hours on an ordinary PC.</p>

Improved preimage attacks on round-reduced Keccak-384/512

期刊论文
发表日期：

2026年2月18日

查看全文

Le He,
Xiaoen Lin,
Hongbo Yu

摘要

This paper provides improved preimage attack results on round-reduced Keccak-384/512. Keccak is the winner of SHA-3 competition and it contains four main variants: Keccak-224, Keccak-256, Keccak-384 and Keccak-512. Different from short-output variants, Keccak-384/512 outputs from two parts of its state: the entire 320-bit first plane and a 64/192-bit truncation of the second plane. Due to lack of degrees of freedom, most existing preimage analysis can only control the first 320-bit plane and thus achieve limited results. By thoroughly analyzing the algebraic structure of Keccak, this paper proposes a technique named “extra linear dependence”, which can construct linear relations between corresponding bits in two planes. To apply such technique, this paper inherits pioneers’ attack thoughts that convert output bits to linear or quadratic equations of input variables. When solving the final equation system, those linear relations can lead to extra restricting equations of output, exceeding the limit of matrix rank. As a result, the complexities of preimage attacks on 2-round and 3-round Keccak-384/512 can be decreased to $2^{39}$ $2^{39}$ / $2^{204}$ $2^{204}$ and $2^{270}$ $2^{270}$ / $2^{424}$ $2^{424}$ Keccak calls respectively, which are all the best known results so far. To support the theoretical analysis, this paper provides the first preimage of all ‘0’ digest for 2-round Keccak-384, which can be obtained in several hours on an ordinary PC.