Deterministic Constructions of 21-Step Collisions for the SHA-2 Hash Family
TL;DR: Two different deterministic attacks against 21-step SHA-2 hash family are constructed, and it is provided evidence that the Nikolic-Biryukov differential path is unlikely to yield 21- step collisions for SHA-512.
Abstract: Recently, at FSE '08, Nikolic and Biryukov introduced a new technique for analyzing SHA-2 round function. Building on their work, but using other differential paths, we construct two different deterministic attacks against 21-step SHA-2 hash family. Since the attacks are deterministic, they are actually combinatorial constructions of collisions. There are six free words in our first construction. This gives exactly 2192different collisions for 21-step SHA-256 and exactly 2384different collisions for 21-step SHA-512. The second construction has five free words. The best previous result, due to Nikolic and Biryukov, for finding collisions for 21-step SHA-256 holds with probability 2i¾? 19. No results on 21-step SHA-512 are previously known. Further, we provide evidence that the Nikolic-Biryukov differential path is unlikely to yield 21-step collisions for SHA-512.