Distinguisher on full-round compression function of GOST R

Abstract From January 2013, GOST R 34.11-2012 hash function has been the new Russian Federal standard hash function which replaced the old one GOST R 34.11-97. GOST R hash function can compress any message up to 2512 bits into 256 bits and 512 bits, which are called GOST R-256 and GOST R-512 respectively. In this paper, we present distinguishers for the compression function and its internal permutation of GOST R hash function by exploiting the integral cryptanalysis. Firstly, we propose an 8.75-round known-key distinguisher for the internal permutation with the time complexity of 2128. Then by extending the distinguisher, we propose the known-key distinguisher for 12-round internal permutation with the time complexity of 2192.4, and the memory is about 2129 bytes. Since the compression function is designed by the Miyaguchi-Preneel mode, we can transform the distinguishers for permutation to ones for the compression function. As a result, we present the 8.75-round and full 12-round distinguishers for the GOST R compression function. This is the first publish to propose distinguishers for full-round GOST R compression function and its internal permutation.