The Cramér-von Mises family of goodness-of-fit statistics is a well-known group of statistics used to test fit to a continuous distribution. In this article we extend the family to provide tests for discrete distributions. The statistics examined are the analogues of those associated with the names of Cramér-von Mises, Watson and Anderson-Darling, called W , U and A respectively, and their components. We provide formulas for the test statistics, and asymptotic percentage points for the test for a uniform distribution with k cells. The tests are based on the empirical distribution function (EDF) of the sample. They are closely related to Pearson’s X test, and to Neyman-Barton smooth tests; in particular, all the tests can be broken down into components, as has been observed by many authors. It is suggested that A be used to test the overall null hypothesis in general, and U for the particular case where observations are counts around a circle. Their components can be used to test for particular types of departure from the null. In section 2, we define the test statistics and give the general distribution theory. In section 3 the solution of the uniform case is given, together with

Cramér-Von Mises Statistics for Discrete Distributions.

In recent years, the amount of electronic communication has grown enormously. This has posed some new problems in information security. In particular, the methods in cryptography have been under much scrutiny. There are several basic primitives that modern cryptographic protocols utilise. One of these is hash functions, which are used to compute short hash values from messages of any length. In this thesis, we study the security of hash functions from two different viewpoints. First of all, we analyse the security of the Very Smooth Hash against preimage attacks. We develop an improved method for finding preimages of Very Smooth Hash, compare this method with existing methods and demonstrate its efficiency with practical results. Furthermore, we generalise this method to the discrete logarithm variants of the Very Smooth Hash. Secondly, we describe the methods for finding multicollisions in traditional iterated hash functions and give some extensions and improvements to these. We also outline a method for finding multicollisions for generalised iterated hash functions and discuss the implications of these findings. In addition, we generalise these multicollision finding methods to some graph-based hash functions.

/pdf/hash-function-security-cryptanalysis-of-the-very-smooth-hash-26pz6n7bzi.pdf

Hash function security : cryptanalysis of the Very Smooth Hash and multicollisions in generalised iterated hash functions

This paper presents preimage attacks on the hash functions 3-pass HAVAL and step-reduced MD5. Introduced in 1992 and 1991 respectively, these functions underwent severe collision attacks, but no preimage attack. We describe two preimage attacks on the compression function of 3-pass HAVAL. The attacks have a complexity of about 2224 compression function evaluations instead of 2256. We present several preimage attacks on the MD5 compression function that invert up to 47 steps (out of 64) within 296 trials instead of 2128. Although our attacks are not practical, they show that the security margin of 3-pass HAVAL and step-reduced MD5 with respect to preimage attacks is not as high as expected.

https://lirias.kuleuven.be/bitstream/123456789/329806/2/article-2089.pdf

Preimage Attacks on 3-Pass HAVAL and Step-Reduced MD5

In this paper, we show that some new variants of the Very Smooth Hash (VSH) hash function are susceptible to similar types of preimage attacks as the original VSH. We also generalise the previous mathematical results, which have been used in the preimage attacks. VSH is a hash function based on the multiexponentiation of prime numbers modulo some large product of two primes. The security proof of VSH is based on some computational problems in number theory, which are related to the problem of factoring large integers. However, the preimage resistance of VSH has been studied and found somewhat lacking especially in password protection. There have been many different variants of VSH proposed by the original authors and others. Especially the discrete logarithm version of VSH has been proposed in order to make the hash values shorter. Further proposals have used the discrete logarithm in finite fields and elliptic curves to gain even more advantage to the hash length. Our results demonstrate that even for these new variants, the same ideas for preimage attacks can be applied as for the original VSH and they result in effective preimage attacks.

Preimage attacks against variants of very smooth hash

The security of hash functions has recently become one of the hottest topics in the design and analysis of cryptographic primitives. Since almost all the hash functions used today (including the MD and SHA families) have an iterated design, it is important to study the general security properties of such functions. At Crypto 2004 Joux showed that in any iterated hash function it is relatively easy to find exponential sized multicollisions, and thus the concatenation of several hash functions does not increase their security. However, in his proof it was essential that each message block is used at most once. In 2005 Nandi and Stinson extended the technique to handle iterated hash functions in which each message block is used at most twice. In this paper we consider the general case and prove that even if we allow each iterated hash function to scan the input multiple times in an arbitrary expanded order, their concatenation is not stronger than a single function. Finally, we extend the result to tree-based hash functions with arbitrary tree structures.

Breaking the ICE : Finding Multicollisions in Iterated Concatenated and Expanded (ICE) Hash Functions

In this paper we improve Saarinen's method for finding preimages of very smooth hash (VSH) hash values and generalise it to some of the variants of VSH proposed by Contini et al. VSH is a new hash function that has been proved to be collision resistant under similar assumptions on the factoring of large integers as the RSA cipher. Saarinen has developed a method for finding preimages of VSH hash values and in his paper he gave an example of its application to 169-bit VSH and 4-character passwords consisting of lowercase alphabets. Because there were no results on the practical effectiveness of this approach with cryptographically significant security parameters, we give some results on the time and memory required to find the preimages of 8-character alphanumeric passwords secured by 1024-bit and 2048-bit VSH on quite modest hardware. In our study we implemented both the original VSH and the cubing variant of VSH. Our results show that both Saarinen's method and our method can find preimages of password hash values very quickly and that our method is faster in many cases. Our method also uses reusable tables that can be used to find the preimages of subsequent hash values faster than with the original method.

On the Security of VSH in Password Schemes

In this paper we present an improvement to the preimage attacks on Very Smooth Hash (VSH) function. VSH was proposed as a collision resistant hash function by Contini et al., but it has been found lacking in preimage resistance by Saarinen. With our method, we show how to find preimages of multiple passwords secured by VSH. We also demonstrate that our method is faster in finding preimages of multiple passwords than the methods proposed earlier. We tested the methods with five, ten and fifty randomised alphanumeric passwords. The results show that our method is many times faster than the original method of Saarinen and almost three times faster than the improved method proposed by Halunen et al. Furthermore, we argue that the methods presented previously and our method are essentially the only significantly different methods derivable from Saarinen's work.

Finding Preimages of Multiple Passwords Secured with VSH

In this article, we combine the Alias method with the concept of systematic sampling, a method commonly used in particle filters for efficient low-variance resampling. The proposed method allows very fast sampling from a discrete distribution: drawing k samples is up to an order of magnitude faster than binary search from the cumulative distribution function (cdf) or inversion methods used in many libraries. The produced empirical distribution function is evaluated using a modified Cramer-Von Mises goodness-of-fit statistic, showing that the method compares very favorably to multinomial sampling. As continuous distributions can often be approximated with discrete ones, the proposed method can be used as a very general way to efficiently produce random samples for particle filter proposal distributions, for example, for motion models in robotics.

Pauli Rikula

Papers

On the Security of VSH in Password Schemes

Finding Preimages of Multiple Passwords Secured with VSH

Systematic Alias Sampling: An Efficient and Low-Variance Way to Sample from a Discrete Distribution