High-rate multi-block-length hash function based on block ciphers

1. A method of hashing a message M using a block cipher, comprising:

producing N block cipher inputs by XORing message indices i, . . . i+N−1 respectively with state values S 0 , . . . S N−1 , wherein N is an integer greater than 1;

producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0 , . . . S N−1 for each of the N block cipher keys;

encrypting the N block cipher inputs using the respective N block cipher keys to produce N block cipher outputs;

combining the N block cipher outputs with N block cipher inputs to produce N block cipher combined outputs T t , for t=0, . . . , N−1;

calculating Y 0 =T 0 ;

calculating Y t =Y t−1 ⊕T t , for t=1, . . . , N−1,

calculating S N−1 ′=Y N−1 <<<a, where a is a number of bits to rotate where S 0 ′, . . . , S N−1 ′ are new state values; and

calculating S t ′=Y t ⊕S N−1 ′, for t=0, . . . , N−2.

2. The method of claim 1 , wherein producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0 , . . . S N−1 for each of the N block cipher keys, further includes:

calculating

X t =⊕ j=0 N−1 M r·N+(t+δ(j))% N−j·N ·x δ(j) mod p(x), for t=0, . . . , N−1,

where r is a round number and δ(j)=j·(j−1)/2 for j>0 and 0 for j=0 and p(x) is a primitive polynomial of degree k where k is the size in bits of the key for the block cipher;

calculating S t =⊕ j≠t S j , zero padded to k bits, for t=0, . . . , N−1; and

calculating X t ⊕ S t for t=0, . . . , N−1 as the N block cipher keys.

3. The method of claim 2 , wherein δ(j) is 0, 0, 1, 3 for j=0, . . . , 3 for N≤4.

4. The method of claim 1 , wherein S 0 , . . . S N−1 are initialized to predefined values.

5. The method of claim 1 , wherein

N=2,

a first block cipher key is M i ⊕M i−2 ⊕S 1 , and

a second block cipher key is M i+1 ⊕M i−1 ⊕S 0 .

6. The method of claim 1 , wherein

N=3,

a first block cipher key is M i ⊕M i−3 ⊕x·M i−5 ⊕S 1 ⊕S 2 , and

a second block cipher key is M i+1 ⊕M i−2 ⊕x·M i−4 ⊕S 0 ⊕S 2 ,

a third block cipher key is M i+2 ⊕M i−1 ⊕x·M i−6 ⊕S 0 ⊕S 1 .

7. The method of claim 1 , wherein

N=4,

a first block cipher key is M i ⊕M i−4 ⊕x·M i−7 ⊕x 3 ·M i−9 ⊕S 1 ⊕S 2 ⊕S 3 ,

a second block cipher key is M i+1 ⊕M i−3 ⊕x·M i−6 ⊕x 3 ·M i−12 ⊕S 0 ⊕S 1 ⊕S 2 ⊕S 3 ,

a third block cipher key is M i+2 ⊕M i−2 ⊕x·M i−5 ⊕x 3 ·M i−11 ⊕S 0 ⊕S 1 ⊕S 3 , and

a fourth block cipher key is M i+3 ⊕M i−1 ⊕x·M i−8 ⊕x 3 ·M i−10 ⊕S 0 ⊕S 1 ⊕S 1 ⊕S 2 .

8. A non-transitory machine-readable storage medium encoded with instructions for hashing a message M using a block cipher, the non-transitory machine-readable storage medium comprising:

instructions for producing N block cipher inputs by XORing message indices i, . . . i+N−1 respectively with state values S 0 , . . . S N−1 , wherein N is an integer greater than 1;

instructions for producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0 , . . . S N−1 for each of the N block cipher keys;

instructions for encrypting the N block cipher inputs using the respective N block cipher keys to produce N block cipher outputs;

instructions for combining the N block cipher outputs with N block cipher inputs to produce N block cipher combined outputs T t , for t=0, . . . , N−1;

instructions for calculating Y 0 =T 0 ;

instructions for calculating Y t =Y t−1 ⊕T t , for t=1, . . . , N−1,

instructions for calculating S N−1 ′=Y N−1 <<<a, where a is a number of bits to rotate where S 0 ′, . . . , S N−1 ′ are new state values; and

instructions for calculating S t ′=Y t ⊕S N−1 ′, for t=0, . . . , N−2.

9. The non-transitory machine-readable storage medium of claim 8 , wherein producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0 , . . . S N−1 for each of the N block cipher keys, further includes:

instructions for calculating

X t =⊕ j=0 N−1 M r·N+(t+δ(j))% N−j·N ·x δ(j) mod p(x), for t=0, . . . , N−1,

where r is a round number and δ(j)=j·(j−1)/2 for j>0 and 0 for j=0 and p(x) is a primitive polynomial of degree k where k is the size in bits of the key for the block cipher;

calculating S t =⊕ j≠t S j , zero padded to k bits, for t=0, . . . , N−1; and

calculating X t ⊕ S t for t=0, . . . , N−1 as the N block cipher keys.

10. The non-transitory machine-readable storage medium of claim 9 , wherein δ(j) is 0, 0, 1, 3 for j=0, . . . , 3 for N≤4.

11. The non-transitory machine-readable storage medium of claim 8 , wherein S 0 , . . . S N−1 are initialized to predefined values.

12. The non-transitory machine-readable storage medium of claim 8 , wherein

N=2,

a first block cipher key is M i ⊕M i−2 ⊕S 1 , and

a second block cipher key is M i+1 ⊕M i−1 ⊕S 0 .

13. The non-transitory machine-readable storage medium of claim 8 , wherein

N=3,

a first block cipher key is M i ⊕M i−3 ⊕x·M i−5 ⊕S 1 ⊕S 2 , and

a second block cipher key is M i+1 M i−2 ⊕x·M i−4 ⊕S 0 ⊕S 2 ,

a third block cipher key is M i+2 ⊕M i−1 ⊕x·M i−6 ⊕S 0 ⊕S 1 .

14. The non-transitory machine-readable storage medium of claim 8 , wherein

N=4,

a first block cipher key is M i ⊕M i−4 ⊕x·M i−7 ⊕x 3 ·M i−9 ⊕S 1 ⊕S 2 ⊕S 3 ,

a second block cipher key is M i+1 ⊕M i−3 ⊕x·M i−6 ⊕x 3 ·M i−12 ⊕S 0 ⊕S 2 ⊕S 3 ,

a third block cipher key is M i+2 ⊕M i−2 ⊕x·M i−5 ⊕x 3 ·M i−11 ⊕S 0 ⊕S 1 ⊕S 3 , and

a fourth block cipher key is M i+3 ⊕M i−1 ⊕x·M i−8 ⊕x 3 ·M i−10 ⊕S 0 ⊕S 1 ⊕S 2 .