A 2nd-Preimage Attack on AURORA-512.
Yu Sasaki · 2009
Abstract. In this note, we present a 2nd-preimage attack on AURORA-512, which is one of the candidates for SHA-3. Our attack can generate 2nd-preimages of any given message, in particular, the attack complexity becomes optimal when the message length is 9 blocks or more. In such a case, the attack complexity is approximately 2 290 AURORA-512 operations, which is less than the brute force attack on AURORA-512, namely, 2 512−log2 9 ≈ 2 508. Our attack exploits some weakness in the mode of operation.