In cryptography, SWIFFT is a collection of provably secure hash functions. It is based on the concept of the fast Fourier transform (FFT). SWIFFT is not the first hash function based on the FFT, but it sets itself apart by providing a mathematical proof of its security. It also uses the LLL basis reduction algorithm. It can be shown that finding collisions in SWIFFT is at least as difficult as finding short vectors in cyclic/ideal lattices in the worst case. By giving a security reduction to the worst-case scenario of a difficult mathematical problem, SWIFFT gives a much stronger security guarantee than most other cryptographic hash functions. Unlike many other provably secure hash functions, the algorithm is quite fast, yielding a throughput of 40 Mbit/s on a 3.2 GHz Intel Pentium 4. Although SWIFFT satisfies many desirable cryptographic and statistical properties, it was not designed to be an "all-purpose" cryptographic hash function. For example, it is not a pseudorandom function, and would not be a suitable instantiation of a random oracle. The algorithm is less efficient than most traditional hash functions that do not give a proof of their collision-resistance. Therefore, its practical use would lie mostly in applications where the proof of collision-resistance is particularly valuable, such as digital signatures that must remain trustworthy for a long time. A modification of SWIFFT called SWIFFTX was proposed as a candidate for SHA-3 function to the NIST hash function competition and was rejected in the first round.

The algorithm

The algorithm is as follows: mn p1, …, pm in a certain polynomial ring R with binary coefficients. pi using SWIFFT. ai , so that they are fixed and depend on a family of SWIFFT. pi with the Fourier coefficients of ai for each i. fi of degree < 2n . αn + 1 . n log(p) bits and output it. The FFT operation in step 4 is easy to invert, and is performed to achieve diffusion, that is, to mix the input bits. The linear combination in step 6 achieves confusion, since it compresses the input. This is just a high level description of what the algorithm does, some more advanced optimizations are used to finally yield a high performing algorithm.

Example

Assuming the parameters (n, m, p) = (64, 16, 257) , any fixed compression function in the family takes a binary input of length mn = 1024 bits (128 bytes) to an output in the range ℤn p , which has size pn = 25764 . An output in ℤn p can easily be represented using 528 bits (66 bytes).

Algebraic description

The SWIFFT functions can be described as a simple algebraic expression over some polynomial ring R. A family of these functions depends on three main parameters: let n be a power of 2, let m > 0 be a small integer, and let p > 0 be a modulus (not necessarily prime, but is convenient to choose it prime). Define R to be the ring R = ℤp[α]/(αn + 1) , i.e., the ring of polynomials in α having integer coefficients, modulo p and αn + 1 . An element of R can be written as a polynomial of degree < n having coefficients in ℤp . A certain function in the SWIFFT family is specified by m fixed elements a1, …, am ∈ R of the ring R, that are called multipliers. The function corresponds to the following formula over R: The x1, …, xm ∈ R are polynomials with binary coefficients, and corresponding to the binary input of length mn .

Computing the polynomial product

To compute the above expression, the main problem is to compute the polynomial products ai ⋅ xi . A fast way to compute these products is given by the convolution theorem. This says that under certain restrictions, = ⋅ , where denotes the Fourier transform and ⋅ denotes the pointwise product. In the general case of the convolution theorem, ∗ does not denote multiplication but convolution. It can, however, be shown that polynomial multiplication is a convolution.

Fast Fourier transform

The fast Fourier transform is used to find the Fourier coefficients of each polynomial, which are then multiplied point-wise with the respective Fourier coefficients of the other polynomial. The resulting coefficients are then transformed to a polynomial of degree < 2n using an inverse fast Fourier transform.

Number-theoretic transform

Instead of the normal Fourier transform, SWIFFT uses the number-theoretic transform. The number-theoretic transform uses roots of unity in ℤp instead of complex roots of unity. In order for this to work, ℤp needs to be a finite field and primitive 2n th roots of unity need to exist in this field. This can be done by taking p prime such that 2n divides p − 1 .

Parameter choice

The parameters m, p, and n are subject to the following restrictions: p − 1 must be a multiple of 2n , and log(p) < m (otherwise the output will not be smaller than the input). A possible choice is (n,m,p) = (64,16,257) , which achieves a throughput of about 40 Mbit/s, security of about 2106 operations for finding collisions, and a digest size of 512 bits.

Statistical properties

f(x) = f(y) is the inverse of the size of the range. f(x) is distributed uniformly over the range.

Cryptographic properties and security

x + y is also a valid input, we have that f(x) + f(y) = f(x + y) . This relation is very unlikely to hold for a random function, so an adversary can easily distinguish our functions from a random function.

Theoretical security

SWIFFT is an example of a provably secure cryptographic hash function. As with most security proofs, the security proof of SWIFFT relies on a reduction to a certain difficult-to-solve mathematical problem. Note that this means that the security of SWIFFT relies strongly on the difficulty of this mathematical problem. The reduction in the case of SWIFFT is to the problem of finding short vectors in cyclic/ideal lattices. It can be proven that the following holds: Suppose we have an algorithm that, for a random version of SWIFFT given by f, can find collisions in f within some feasible time T, and with probability p. It is allowed that the algorithm only works in a small but noticeable fraction of the SWIFFT family. Then we can find also an algorithm f2 which can always find a short vector in any ideal lattice over the ring ℤp[α]/(αn + 1) in some feasible time T2 , depending on T and p. This means that finding collisions in SWIFFT is at least as difficult as the worst-case scenario of finding short vectors in a lattice over ℤp[α]/(αn + 1) . At the moment, the fastest algorithms for finding short vectors are all exponential in n. Note that this ensures that there is no significant set of "weak instances" where the security of SWIFFT is weak. This guarantee is not given by most other provably secure hash functions.

Practical security

Known working attacks are the generalized birthday attack, which takes 2106 operations, and inversion attacks which takes 2448 operations for a standard parameter choice. This is usually considered to be enough to render an attack by an adversary infeasible.