| [1] Wang X Y, Lai X J, Feng D G, Chen H, Yu X Y. Cryptanalysisof the hash functions MD4 and RIPEMD. In Proc. the24th EUROCRYPT 2005, May 2005, pp.1-18.[2] Wang X Y, Yin Y L, Yu H B. Finding collisions in the fullSHA-1. In Proc. the 25th CRYPTO 2005, August 2005,pp.17-36.[3] Wang X Y, Yu H B. How to break MD5 and other hash functions.In Proc. the 24th EUROCRYPT 2005, May 2005,pp.19-35.[4] Wang X Y, Yu H B, Yin Y L. Efficient collision search attackson SHA-0. In Proc. the 25th CRYPTO 2005, August 2005,pp.1-16.[5] Billet O, Robshaw M J B, Seurin Y, Yin Y L. Looking backat a new hash function. In Proc. the 13th ACISP 2008, July2008, pp.239-253.[6] National Institute of Standards and Technology(NIST). Advanced encryption standard (AES).http://csrc.nist.gov/publications/fips197/fips-197.pdf.[7] Rivest R L, Robshaw M J B, Sidney R, Yin Y L.The RC6TM block cipher (V1.1), August 20, 1998,www.people.csail.mit.edu/rivest/pubs/RRSY98.pdf.[8] Wagner D. The Boomerang attack. In Proc. the 6th FSE,March 1999, pp.156-170.[9] Biryukov A, Nikolic I, Roy A. Boomerang attacks on BLAKE-32. In Proc. the 18th FSE, February 2011, pp.218-237.[10] Lamberger M, Mendel F. Higher-order differential attackon reduced SHA-256. Cryptology ePrint Archive, Report2011/037, 2011, http://eprint.iacr.org/2011/037. |