王小云
博士研究生 教授
山东大学 数学学院
密码算法分析与设计,密码学中的数论代数问题研究,可证明安全计算问题研究。特别在密码算法---hash函数的分析与设计方面
暂无
- 姓名:王小云
- 目前身份:在职研究人员
- 担任导师情况:
- 学位:
-
学术头衔:
博士生导师
- 职称:高级-教授
-
学科领域:
数理逻辑与数学基础
- 研究兴趣:密码算法分析与设计,密码学中的数论代数问题研究,可证明安全计算问题研究。特别在密码算法---hash函数的分析与设计方面
王小云,女,1966年生,1993年获得数论与密码学研究领域博士。杨振宁讲座教授,山东大学密码技术与信息安全教育部重点实验室(筹)主任。自1996年至今,先后主持完成了国家“九五”密码发展基金项目,“十五”密码发展基金项目,863计划项目。目前正负责主持自然科学基金重大研究计划面上项目。研究领域为密码算法分析与设计,密码学中的数论代数问题研究,可证明安全计算问题研究。特别在密码算法---hash函数的分析与设计方方面,自1996年至今破解了多个国际通用的系列hash函数算法md4, md5, ripemd, haval-128, shaa-0, sha-1。其中md5与sha-1被广泛用于计算机安全通信,如信息的完整性检测,电子签名,认证技术等关键技术。 md5与sha-1的破解结果于2006年获得陈家庚科学奖。2005关于hash函数研究方面的四篇论文获得最佳论文奖,其中crypto 05 最佳论文1篇,eurocrypto 05最佳论文2篇。另外hash函数的部分研究成果于2002年获得密码科技进步一等奖(省部级)。标志性科研成果:利用原创性hash函数密码分析新理论与新技术破解多数国际通用的hash函数算法。2004-2005标志性论文7篇,自2004年8月结果公布以来,sci刊物被他人引用57次。
-
凯发k8国际首页主页访问
3242
-
关注数
1
-
成果阅读
3301
-
成果数
10
上传时间
2006-09-21
王小云, xiaoyun wang and hongbo yu
eurocrypt 2005, lncs 3494, pp. 19-35, 2005.,-0001,():
-1年11月30日
md5 is one of the most widely used cryptographic hash functions nowadays. it was designed in 1992 as an improvement of md4, and its security was widely studied since then by several authors. the best known result so far was a semi free-start collision, in which the initialvalue of the hash function is replaced by a non-standard value, which is the result of the attack. in this paper we present a new powerful attack on md5 which allows us to find collisions efficiently. we used this attack to find collisions of md5 in about 15 minutes up to an hour computation time. the attack is a differential attack, which unlike most differential attacks, does not use the exclusive-or as a measure of difference, but instead uses modular integer subtraction as the measure. we call this kind of differential a modular differential. an application of this attack to md4 can find a collision in less than a fraction of a second. this attack is also applicable to other hash functions, such as ripemd and haval.
-
379浏览
-
0点赞
-
0收藏
-
0分享
-
229下载
-
引用
上传时间
2006-09-21
王小云, xiaoyun wang, xuejia lai, dengguo feng, hui chen, and xiuyuan yu
eurocrypt 2005, lncs 3494, pp. 1-18, 2005.,-0001,():
-1年11月30日
md4 is a hash function developed by rivest in 1990. it serves as the basis for most of the dedicated hash functions such as md5, shax, ripemd, and haval. in 1996, dobbertin showed how to find collisions of md4 with complexity equivalent to 220 md4 hash computations. in this paper, we present a new attack on md4 which can find a collision with probability 2-2 to 2−6, and the complexity of finding a collision doesn't exceed 28 md4 hash operations. built upon the collision search attack, we present a chosen-message pre-image attack on md4 with complexity below 28. furthermore, we show that for a weak message, we can find another message that produces the same hash value. the complexity is only a single md4 computation, and a random message is a weak message with probability 2−122. the attack on md4 can be directly applied to ripemd which has two parallel copies of md4, and the complexity of finding a collision is about 218 ripemd hash operations.
-
281浏览
-
0点赞
-
0收藏
-
0分享
-
131下载
-
引用
上传时间
2006-09-21
王小云, xiaoyun wang, hongbo yu, and yiqun lisa yin
crypto 2005, lncs 3621, pp. 1-16, 2005.,-0001,():
-1年11月30日
in this paper, we present new techniques for collision search in the hash function sha-0. using the new techniques, we can find collisions of the full 80-step sha-0 with complexity less than 239 hash operations.
hash functions,, collision search attacks,, sha-0,, sha-1.,
-
115浏览
-
0点赞
-
0收藏
-
0分享
-
112下载
-
引用
上传时间
2006-09-21
王小云, xiaoyun wang*, yiqun lisa yin, and hongbo yu
crypto 2005, lncs 3621, pp. 17-36, 2005.,-0001,():
-1年11月30日
in this paper, we present new collision search attacks on the hash function sha-1. we show that collisions of sha-1 can be found with complexity less than 269 hash operations. this is the first attack on the full 80-step sha-1 with complexity less than the 280 theoretical bound.
hash functions,, collision search attacks,, sha-1,, sha-0
-
187浏览
-
0点赞
-
0收藏
-
0分享
-
146下载
-
引用
上传时间
2006-09-21
王小云, 王小云**, 冯登国, 于秀源
中国科学e辑信息科学,2005,35(3):1~12,-0001,():
-1年11月30日
给出了一种hash函数haval-128的有效攻击方法. haval是由zheng等人在auscrypto'92提出的,它的轮数可以是3、4或5,输出长度为128、160、192或224比特的杂凑值本文攻击的是具有128比特杂凑值的haval算法本文的主要结论是,任给一个1024比特长的消息m,只要对m做一些适当的修改,修改后的消息m就会和另外一个消息m'以2-7的概率发生碰撞,其中m'=m △m,△m是事先选定的一个固定的明文差分另外,本文还给出了两个碰撞的实例.
hash函数, 碰撞, 差分分析, 差分特征
-
218浏览
-
0点赞
-
0收藏
-
0分享
-
154下载
-
引用
上传时间
2006-09-21
王小云, hongbo yu, gaoli wang, guoyan zhang, and xiaoyun wang
cans 2005, lncs 3810, pp. 1-12, 2005.,-0001,():
-1年11月30日
in eurocrypt'05, wang et al. presented new techniques to find collisions of hash function md4. the techniques are not only efficient to search for collisions, but also applicable to explore the secondpreimage of md4. about the second-preimage attack, they showed that a random message was a weak message with probability 2−122 and it only needed a one-time md4 computation to find the second-preimage corresponding to the weak message. a weak message means that there exits a more efficient attack than the brute force attack to find its secondpreimage. in this paper, we find another new collision differential path which can be used to find the second-preimage for more weak messages. for any random message, it is a weak message with probability 2−56, and it can be converted into a weak message by message modification techniques with about 227 md4 computations. furthermore, the original message is close to the resulting message (weak message), i. e, the hamming weight of the difference for two messages is about 44.
hash function,, collision differential path,, second-preimage,, weak message.,
-
270浏览
-
0点赞
-
0收藏
-
0分享
-
103下载
-
引用
上传时间
2006-09-21
王小云, x. y. wang*, l. c. k. hui*, k. p. chow*, c. f. chong*, w. w. tsang*, h. w. chan*
,-0001,():
-1年11月30日
serpent is one of the five aes finalists. in our paper, we give solne differentials about serpent, two of the differentials are a 5-round differential with the probability of 1/207 and a 6-round diffierential with the probability of 1/207. the best known differential before our paper is a 5-round differential with the probability of 1/207 given in [9]. additionally, we provide all the possible best differentials for some cases about serpent. from these best differentials, we eonclude that the 16-round best differential is not higher than 1/207 and that the 17-round differential is less than 1/2128.
-
53浏览
-
0点赞
-
0收藏
-
0分享
-
90下载
-
引用
上传时间
2006-09-21
王小云, l. c. k. hui*, x. y. wang*, k. p. chow*, w. w. tsang*, c. f. chong*, h. w. chan*
,-0001,():
-1年11月30日
in this paper, we use the a 12-round differential (5-16 rounds) to analyze the reduced skipjack variants starting from the first round. the analysis result is that, breaking 1-21 rounds skipjack variant needs about 217 chosen plaintexts and 264 encryptions, breaking 1-24 variant needs about 246 chosen plaintexts and 272 encryptions, and 1-26 variants needs about 246 chosen plaintexts and 260 encryptions.
-
68浏览
-
0点赞
-
0收藏
-
0分享
-
137下载
-
引用
【期刊论文】collisions for hash functions md4, md5, haval-128 and ripemd
王小云, xiaoyun wang, dengguo feng, xuejia lai, hongbo yu
,-0001,():
-1年11月30日
-
1657浏览
-
0点赞
-
0收藏
-
0分享
-
201下载
-
0评论
-
引用
上传时间
2006-09-21
王小云, x. y. wang, l. c. hui, k. p. chow, w. w. tsang, c. f. chong, and h. w. chan
pkc 2000, lncs 1751, pp. 167-177, 2000.,-0001,():
-1年11月30日
in this paper, we present another tree-structure signature scheme based on discrete logarithm problem modulo p, where p is a large prime. the basic signing algorithm is the original elgmal signature scheme. the scheme attains ideal security, i. e, finding existential forgeries under adaptively chosen message attacks is equivalent to solving the discrete logarithm of any random integer y∈z*p. the scheme is also efficient, it can be implemented almost as efficiently as the original elgamal signature scheme. we can regard the scheme as an application of elgamal signature scheme in tree-structure signature schemes.
-
73浏览
-
0点赞
-
0收藏
-
0分享
-
98下载
-
引用