Reports › hash-05 · Constant-time review
uHash (hash-05)
| Candidate | uHash |
|---|---|
| Family | Symmetric (block-cipher-based hash) |
| Archive | uHash.zip (SHA-256: c398e49530510c9aa1deffd617855f9b8db448b4e30a35953d88ea0373c7d8e5) |
hash-05-1: Secret state indexes a 256-byte substitution table
| Severity | Medium |
|---|---|
| Scope | side-channel |
| Status | Confirmed |
| Affected | Reference uHash-512/768/1024 |
| Discovery | Trivial |
| Exploitation | Cache side-channel dependent |
| Credit | Markku-Juhani O. Saarinen markku-juhani.saarinen@tuni.fi, with AI assistance |
| Date | 2026-09-23 |
The reference RoundFunction xors the evolving state with a round key, then reads S[X[i]] and S[Y[i]] (CryptHash_AlgorithmInstance.c:163-174). S contains 256 bytes (:36), spanning cache lines. Equal-length messages can therefore select different lookup addresses during hashing. No complete message-recovery experiment is claimed. See constant_time.md.
Reproducing
Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).
Inspect the cited table accesses in any reference variant. The lookup indices are the evolving P[i] ^ RK[i] bytes, not public counters.