uHash

The final-chunk counter lives in message bits: length extension and a differentiator

Minor break · Demonstrated · Cause: construction

Property: length-extension resistance and indifferentiability (claimed); collision and preimage resistance unaffected

Cost against claim: 2 to 4 chosen queries, probability 1, against claimed length-extension resistance

The final compression call XORs a per-branch counter into the last key bits, which are message bits. A digest of the same message with those bits flipped therefore reveals one branch of the final chaining value. From a few chosen digests of S‖M, an attacker recovers the full chaining value after a secret prefix S and computes H(S‖M‖Y) for any Y without knowing S.

What causes it

• The key of the compression function ends with the message chunk.
• The final call XORs the counter into that key.
• The padding is 10* with no length field.

The specification claims resistance to length extension, but its argument covers extension from a single digest only; it also claims indistinguishability from a random function at 256/384/512 bits, proved as indifferentiability, which a (2b+1)-query differentiator contradicts.

Evidence

• 200/200 forgeries per size on a model rebuilt from the specification, with the specification's counter offset and with the one the code uses; 100/100 per size with the reference code as the oracle.
• 200/200 forgeries on the unmodified reference code (uHash-512).

Cause in the specification: the attack also works on a model built from the specification alone.

Limits

A chosen-message attack against the secret-prefix construction, which the call names among the uses to evaluate. It needs a bit-granular interface, since at most one of the queries can be byte-aligned; the NGCC interface is bit-granular. Collision, preimage and second-preimage resistance are not affected.

Credit

Found by PQC-X.

The second-preimage claim exceeds the generic bound for long messages

Minor break · Argued · Cause: parameter size

Property: second-preimage resistance

Cost against claim: ≈2^h / ℓ for an ℓ-block target, against a claimed 2^h

uHash is a narrow-pipe iterated hash without a length field in its padding. For such a hash the generic second-preimage cost on an ℓ-block target is about 2^h / ℓ, below the claimed 2^h for any long message; the specification's own theorem does not reach the claim either.

Evidence

Cause in the specification, traced to the specification text.

Credit

Found by PQC-X.

The digest depends on bits beyond the stated message length

Holds · Demonstrated · Cause: code

Property: determinism of the interface; no claimed property shown to fall

Cost against claim: two callers holding the same message can get different digests

When the bit length is not a multiple of 8, the submitted uHash code lets the unused bits of the last byte change the digest.

Evidence

Found by fuzzing the reference code through the NGCC interface, 20/20.

Cause in the submitted code; the specification is not affected.

Credit

Found by PQC-X.