T. Lai-massey-structure and .. , 110 7.2 Snippet for a bitsliced C implementation of Littlun- 111 7.3 Snippet for a bitsliced C implementation of Littlun-1

S. One-step-of, 140 9.1 A good (one bit) disturbance vector for SHA-0, ., vol.150, issue.92

. Bibliography, R. Martin, B. Albrecht, . Driessen, G. Elif-bilge-kavun et al., Block Ciphers -Focus on the Linear Layer, CRYPTO 2014, pp.57-76, 2014.

D. Augot and M. Finiasz, Exhaustive search for small dimension recursive MDS diffusion layers for block ciphers and hash functions, 2013 IEEE International Symposium on Information Theory, pp.1551-1555, 2013.
DOI : 10.1109/ISIT.2013.6620487
URL : https://hal.archives-ouvertes.fr/hal-00823082

D. Augot and M. Finiasz, Direct Construction of Recursive MDS Diffusion Layers Using Shortened BCH Codes, Cid and Rechberger [CR15]
DOI : 10.1007/978-3-662-46706-0_1
URL : https://hal.archives-ouvertes.fr/hal-01044597

D. Augot, P. Fouque, and P. Karpman, Diffusion Matrices from Algebraic-Geometry Codes with Efficient SIMD Implementation, Lecture Notes in Computer Science, vol.8781, pp.243-260, 2014.
DOI : 10.1007/978-3-319-13051-4_15
URL : https://hal.archives-ouvertes.fr/hal-01094085

[. Aoki and Y. Sasaki, Preimage Attacks on One-Block MD4, 63-Step MD5 and More, Lecture Notes in Computer Science, vol.83, issue.1, pp.103-119, 2008.
DOI : 10.1007/11426639_2

[. Aoki and Y. Sasaki, Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1, Halevi [Hal09], pp.70-89
DOI : 10.1007/978-3-642-03356-8_5

. Atmel, 8-bit AVR Microcontroller with 1K Byte Flash

. Atmel, 8-bit AVR Microcontroller with 8KBytes In-System Programmable Flash, Rev, pp.2486-2488, 2013.

E. Biham, R. J. Anderson, and L. R. Knudsen, Serpent: A New Block Cipher Proposal, Lecture Notes in Computer Science, vol.1372, pp.98-222, 1998.
DOI : 10.1007/3-540-69710-1_15
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.130.8684

S. Gilles-barthe, F. Belaïd, P. Dupressoir, B. Fouque, and . Grégoire, Compositional Verification of Higher-Order Masking: Application to a Verifying Masking Compiler, IACR Cryptology ePrint Archive, pp.2015-506, 2015.

A. Biryukov, C. Bouillaguet, and D. Khovratovich, Cryptographic Schemes Based on the ASASA Structure:??Black-Box,??White-Box, and??Public-Key (Extended Abstract), ASIACRYPT 2014 (Palash Sarkar and Tetsu Iwata, pp.63-84, 2014.
DOI : 10.1007/978-3-662-45611-8_4

E. Biham and R. Chen, Near-Collisions of SHA-0 , in Franklin, pp.290-305

C. Boura and A. Canteaut, Another View of the Division Property, pp.654-682
DOI : 10.1007/978-3-662-53018-4_24
URL : https://hal.archives-ouvertes.fr/hal-01401016

[. Boura, A. Canteaut, and C. De-cannière, Higher-Order Differential Properties of Keccak and Luffa, Lecture Notes in Computer Science, vol.6733, pp.252-269, 2011.
DOI : 10.1007/978-3-642-13858-4_15
URL : https://hal.archives-ouvertes.fr/inria-00537741

E. Biham, R. Chen, A. Joux, P. Carribault, C. Lemuet et al., Collisions of SHA-0 and Reduced SHA-1, Cramer [Cra05], pp.36-57
DOI : 10.1007/11426639_3
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.297.2092

E. Biham, R. Chen, and A. Joux, Cryptanalysis of SHA-0 and Reduced SHA-1, Journal of Cryptology, vol.28, issue.1, pp.110-160, 2015.
DOI : 10.1007/s00145-014-9179-8

M. Bellare, R. Canetti, and H. Krawczyk, Keying Hash Functions for Message Authentication, Lecture Notes in Computer Science, vol.1109, issue.96, pp.1-15, 1996.
DOI : 10.1007/3-540-68697-5_1
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.134.8430

G. Bertoni and J. Daemen, Michaël Peeters, and Gilles Van Assche, Sponge functions, Ecrypt Hash Workshop, 2007.

G. Bertoni and J. Daemen, Michaël Peeters, and Gilles Van Assche, On the Indifferentiability of the Sponge Construction, 2008.

[. Bertoni, J. Daemen, M. Peeters, and G. Van-assche, The Keccak reference, 2011.
DOI : 10.1007/978-3-642-38348-9_19

R. Barbulescu and P. Gaudry, Aurore Guillevic, and François Morain, Improving NFS for the Discrete Logarithm Problem in Non-prime Finite Fields, Oswald and Fischlin [OF15], pp.129-155

[. Benadjila and J. Guo, Victor Lomné, and Thomas Peyrin, Implementing Lightweight Block Ciphers on x86 Architectures, Lange et al. [LLL14], pp.324-351
DOI : 10.1007/978-3-662-43414-7_17
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.400.5884

[. Black, S. Halevi, and H. Krawczyk, UMAC: Fast and Secure Message Authentication, p.99
DOI : 10.1007/3-540-48405-1_14
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.114.7878

A. Bogdanov and T. Isobe, White-Box Cryptography Revisited, Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, CCS '15, pp.1058-1069, 2015.
DOI : 10.1145/2810103.2813699

A. Biryukov, The Design of a Stream Cipher LEX, Lecture Notes in Computer Science, vol.4356, pp.67-75, 2006.
DOI : 10.1007/978-3-540-74462-7_6

M. Bellare and T. Kohno, A Theoretical Treatment of Related-Key Attacks: RKA-PRPs, RKA-PRFs, and Applications, Lecture Notes in Computer Science, vol.2656, pp.491-506, 2003.
DOI : 10.1007/3-540-39200-9_31

A. Bogdanov, L. R. Knudsen, G. Leander, C. Paar, A. Poschmann et al., PRESENT: An Ultra-Lightweight Block Cipher, CHES Lecture Notes in Computer Science, vol.4727, pp.450-466, 2007.
DOI : 10.1007/978-3-540-74735-2_31
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.122.2536

M. Bellare, J. Kilian, and P. Rogaway, The Security of the Cipher Block Chaining Message Authentication Code, Journal of Computer and System Sciences, vol.61, issue.3, pp.362-399, 2000.
DOI : 10.1006/jcss.1999.1694

S. L. Paulo, V. Barreto, and . Rijmen, The Khazad Legacy-Level Block Cipher, 2001.

S. L. Paulo, V. Barreto, and . Rijmen, The Whirlpool Hashing Function, 2003.

A. Biryukov and A. Shamir, Structural Cryptanalysis of SASAS, EURO- CRYPT, Lecture Notes in Computer Science, vol.2045, pp.394-405, 2001.
DOI : 10.1007/s00145-010-9062-1
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.106.3400

R. Beaulieu, D. Shors, J. Smith, and S. Treatman-clark, The SIMON and SPECK Families of Lightweight Block Ciphers, IACR Cryptology ePrint Archive, pp.2013-404, 2013.

A. Bogdanov, E. Tischhauser, and P. S. Vejre, Multivariate Linear Cryptanalysis: The Past and Future of PRESENT, IACR Cryptology ePrint Archive, vol.2016, p.667, 2016.

A. Canteaut, S. Duval, and G. Leurent, Construction of Lightweight S-Boxes Using Feistel and MISTY Structures, Lecture Notes in Computer Science, vol.28, issue.4, pp.373-393, 2015.
DOI : 10.1007/978-3-642-21554-4_19
URL : https://hal.archives-ouvertes.fr/hal-01205187

Y. Jean-sébastien-coron and . Dodis, Cécile Malinaud, and Prashant Puniya, Merkle-Damgård Revisited: How to Construct a Hash Function, Shoup [Sho05], pp.430-448

[. Chow, P. A. Eisen, H. Johnson, and P. C. Van-oorschot, White-Box Cryptography and an AES Implementation, Lecture Notes in Computer Science, vol.2595, pp.250-270, 2002.
DOI : 10.1007/3-540-36492-7_17
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.59.7710

J. Jean-sébastien-coron, M. Großschädl, P. Tibouchi, and . Vadnala, Conversion from Arithmetic to Boolean Masking with Logarithmic Complexity, pp.130-149

J. Jean-sébastien-coron, P. Großschädl, and . Vadnala, Secure Conversion between Boolean and Arithmetic Masking of Any Order, Batina and Robshaw [BR14], pp.188-205

Y. Joo and . Cho, Linear Cryptanalysis of Reduced-Round PRESENT , CT-RSA, Lecture Notes in Computer Science, vol.5985, pp.302-317, 2010.

[. Chabaud and A. Joux, Differential collisions in SHA-0, Lecture Notes in Computer Science, vol.1462, pp.56-71, 1998.
DOI : 10.1007/BFb0055720

K. Cui, K. Jia, S. Fu, M. Chen, and . Wang, New Automatic Search Tool for Impossible Differentials and Zero-Correlation Linear Approximations, IACR Cryptology ePrint Archive, pp.2016-689, 2016.

[. Chen and C. Lu, A Serial-In???Serial-Out Hardware Architecture for Systematic Encoding of Hermitian Codes via Gr??bner Bases, IEEE Transactions on Communications, vol.52, issue.8, pp.1322-1332, 2004.
DOI : 10.1109/TCOMM.2004.833020

[. Collard and F. Standaert, A Statistical Saturation Attack against the Block Cipher PRESENT, Lecture Notes in Computer Science, vol.5473, pp.195-210, 2009.
DOI : 10.1007/978-3-540-68164-9_4
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.188.2035

S. Chen and J. P. Steinberger, Tight Security Bounds for Key-Alternating Ciphers, pp.327-350
DOI : 10.1007/978-3-642-55220-5_19
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.295.903

[. Cogliati and Y. Seurin, On the Provable Security of the Iterated Even-Mansour Cipher Against Related-Key and Chosen-Key Attacks, Oswald and Fischlin [OF15], pp.584-613
DOI : 10.1007/978-3-662-46800-5_23

J. Daemen, Cipher and Hash Function Design Strategies based on linear and differential cryptanalysis, 1995.

I. Damgård, A Design Principle for Hash Functions, pp.416-427
DOI : 10.1007/0-387-34805-0_39

H. Dobbertin, A. Bosselaers, and B. Preneel, RIPEMD-160: A strengthened version of RIPEMD, Gollmann [Gol96], pp.71-82
DOI : 10.1007/3-540-60865-6_44

I. Dinur, O. Dunkelman, T. Kranz, and G. Leander, Decomposing the ASASA Block Cipher Construction, IACR Cryptology ePrint Archive, vol.2015, p.507, 2015.

R. Drews and D. , Formal Aspects of Mobile Code Security, 1999.

[. Dobraunig, M. Eichlseder, and F. Mendel, Related-Key Forgeries for Pr??st-OTR, pp.282-296
DOI : 10.1007/978-3-662-48116-5_14

[. Diffie and M. E. Hellman, Special Feature Exhaustive Cryptanalysis of the NBS Data Encryption Standard, Computer, vol.10, issue.6, pp.74-84, 1977.
DOI : 10.1109/C-M.1977.217750

I. Dinur, Cryptanalytic Time-Memory-Data Tradeoffs for FX-Constructions with Applications to PRINCE and PRIDE, pp.231-253
DOI : 10.1007/978-3-662-46800-5_10
URL : https://hal.archives-ouvertes.fr/hal-01235168

O. Dunkelman and N. Keller, A New Attack on the LEX Stream Cipher, Lecture Notes in Computer Science, vol.107, issue.5, pp.539-556, 2008.
DOI : 10.1007/3-540-69053-0_17

J. Daemen, L. R. Knudsen, and V. Rijmen, The block cipher Square, Lecture Notes in Computer Science, vol.1267, pp.149-165, 1997.
DOI : 10.1007/BFb0052343

O. Dunkelman, N. Keller, and A. Shamir, Minimalism in Cryptography: The Even-Mansour Scheme Revisited, Lecture Notes in Computer Science, vol.7237, pp.2012-336, 2012.
DOI : 10.1007/978-3-642-29011-4_21

C. Delerablée, T. Lepoint, P. Paillier, and M. Rivain, White-Box Security Notions for Symmetric Encryption Schemes, pp.247-264
DOI : 10.1007/978-3-662-43414-7_13

J. Daemen, M. Peeters, G. Van-assche, and V. Rijmen, The Noekeon Block Cipher, 2000.

J. Daemen and V. Rijmen, The Design of Rijndael: AES ? The Advanced Encryption Standard, Information Security and Cryptography, 2002.
DOI : 10.1007/978-3-662-04722-4

C. De, C. , and C. Rechberger, Finding SHA-1 Characteristics: General Results and Applications, Lecture Notes in Computer Science, vol.4284, pp.1-20, 2006.

J. Daemen and V. Rijmen, Probability distributions of correlation and differentials in block ciphers, Journal of Mathematical Cryptology, vol.1, issue.3, pp.221-242, 2007.
DOI : 10.1515/JMC.2007.011

C. De, C. , and C. Rechberger, Preimages for Reduced SHA-0 and SHA-1 , CRYPTO, Lecture Notes in Computer Science, vol.5157, pp.179-202, 2008.

I. Duursma, Weight distributions of geometric Goppa codes, Transactions of the American Mathematical Society, vol.351, issue.09, pp.3609-3639, 1999.
DOI : 10.1090/S0002-9947-99-02179-0

T. Espitau, P. Fouque, and P. Karpman, Higher-Order Differential Meet-in-the-middle Preimage Attacks on SHA-1 and BLAKE, Gennaro and Robshaw [GR15], pp.683-701
DOI : 10.1007/978-3-662-47989-6_33
URL : https://hal.archives-ouvertes.fr/hal-01183070

S. Even and Y. Mansour, A Construction of a Cipher From a Single Pseudorandom Permutation, p.91

P. Fouque and P. Karpman, Security Amplification against Meet-in-the-Middle Attacks Using Whitening, Lecture Notes in Computer Science, vol.8308, pp.252-269, 2013.
DOI : 10.1007/978-3-642-45239-0_15
URL : https://hal.archives-ouvertes.fr/hal-01094298

P. Pierre-alain-fouque, P. Karpman, B. Kirchner, . Minaud, P. Efficient et al., Efficient and Provable White-Box Primitives, Lecture Notes in Computer Science, vol.17, issue.1, pp.159-188, 2016.
DOI : 10.1007/978-3-662-46803-6_15

]. For15a, . Ca-/-browser, and . Forum, Ballot 152 -Issuance of SHA-1 certificates through 2016 , Cabforum mailing list, 2015.

]. For15b, . Ca-/-browser, and . Forum, Ballot 152 -Issuance of SHA-1 certificates through 2016 , Cabforum mailing list, 2015.

[. Farshim and G. Procter, The Related-Key Security of Iterated Even???Mansour Ciphers, pp.342-363
DOI : 10.1007/978-3-662-48116-5_17

K. Matthew and . Franklin, Advances in Cryptology ? CRYPTO, Lecture Notes in Computer Science, vol.3152, 2004.

[. Fulton, Algebraic Curves ? An Introduction to Algebraic Geometry, 2008.

A. Ronald, F. Fisher, and . Yates, Statistical tables for biological, agricultural and medical research, 1948.

A. Evgeny, A. V. Grechnikov, and . Adinetz, Collision for 75-step SHA-1: Intensive Parallelization with GPU , IACR Cryptology ePrint Archive, p.641, 2011.

B. Gérard and V. Grosso, María Naya-Plasencia, and François-Xavier Standaert, Block Ciphers That Are Easier to Mask: How Far Can We Go?, CHES Lecture Notes in Computer Science, vol.2013, issue.8086, pp.383-399, 2013.

P. Gkn-+-14-]-jian-guo, I. Karpman, L. Nikoli?, S. Wang, and . Wu, Analysis of BLAKE2, Lecture Notes in Computer Science, vol.8366, pp.402-423, 2014.

[. Guo, S. Ling, C. Rechberger, and H. Wang, Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2, Lecture Notes in Computer Science, vol.6477, pp.56-75, 2010.
DOI : 10.1007/978-3-642-17373-8_4

[. Grosso and G. Leurent, François-Xavier Standaert, and Kerem Varici, LS-Designs: Bitslice Encryption for Efficient Masked Software Implementations, Cid and Rechberger [CR15], pp.18-37
DOI : 10.1007/978-3-662-46706-0_2

J. Guo, T. Peyrin, and A. Poschmann, The PHOTON Family of Lightweight Hash Functions, Lecture Notes in Computer Science, vol.6841, pp.222-239, 2011.
DOI : 10.1007/978-3-642-22792-9_13

[. Guo, T. Peyrin, A. Poschmann, and M. J. Robshaw, The LED Block Cipher, Lecture Notes in Computer Science, vol.6917, pp.326-341, 2011.
DOI : 10.1007/978-3-642-23951-9_22

H. Gilbert, J. Plût, and J. Treger, Key-Recovery Attack on the ASASA Cryptosystem with Expanding S-Boxes, Gennaro and Robshaw [GR15], pp.475-490
DOI : 10.1007/978-3-662-47989-6_23

M. Hamburg, Accelerating AES with Vector Permute Instructions, Clavier and Gaj [CG09], pp.18-32
DOI : 10.1007/978-3-642-04138-9_2
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.520.9451

C. Heegard, J. Little, and K. Saints, Systematic encoding via Grobner bases for a class of algebraic-geometric Goppa codes, IEEE Transactions on Information Theory, vol.41, issue.6, pp.1752-1761, 1995.
DOI : 10.1109/18.476247

[. Iwata, K. Minematsu, J. Guo, and S. Morioka, CLOC: Authenticated Encryption for Short Input, Cid and Rechberger [CR15], pp.149-167
DOI : 10.1007/978-3-662-46706-0_8
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.431.1635

Y. Ishai, A. Sahai, and D. Wagner, Private Circuits: Securing Hardware against Probing Attacks, Lecture Notes in Computer Science, vol.2729, pp.463-481, 2003.
DOI : 10.1007/978-3-540-45146-4_27
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.115.9436

[. Jeljeli, Accélérateurs logiciels et matériels pour l'algèbre linéaire creuse sur les corps finis. (Hardware and Software Accelerators for Sparse Linear Algebra over Finite Fields), 2015.

A. Joux, Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions, pp.306-316
DOI : 10.1007/978-3-540-28628-8_19

A. Joux and T. Peyrin, Hash Functions and the (Amplified) Boomerang Attack, Lecture Notes in Computer Science, vol.4622, pp.244-263, 2007.
DOI : 10.1007/978-3-540-74143-5_14

P. Junod and S. Vaudenay, FOX : A New Family of Block Ciphers, Lecture Notes in Computer Science, vol.3357, pp.114-129, 2004.
DOI : 10.1007/978-3-540-30564-4_8

P. Karpman, From Distinguishers to Key Recovery: Improved Related-Key Attacks on Even-Mansour, Lecture Notes in Computer Science, vol.9290, pp.177-188, 2015.
DOI : 10.1007/978-3-319-23318-5_10
URL : https://hal.archives-ouvertes.fr/hal-01245365

P. Karpman and B. Grégoire, The Littlun S-box and the Fly Block Cipher, 2016.

S. Knellwolf and D. Khovratovich, New Preimage Attacks against Reduced SHA-1, Safavi-Naini and Canetti [SC12], pp.367-383
DOI : 10.1007/978-3-642-32009-5_22
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.259.6003

P. Karpman, T. Peyrin, and M. Stevens, Practical Free-Start Collision Attacks on 76-step SHA-1, Gennaro and Robshaw [GR15], pp.623-642
DOI : 10.1007/978-3-662-47989-6_30
URL : https://hal.archives-ouvertes.fr/hal-01183066

J. Kilian and P. Rogaway, How to Protect DES Against Exhaustive Key Search (an Analysis of DESX), Journal of Cryptology, vol.14, issue.1, pp.17-35, 2001.
DOI : 10.1007/s001450010015

D. Khovratovich, C. Rechberger, and A. Savelieva, Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 Family, Canteaut [Can12], pp.244-263
DOI : 10.1007/978-3-642-34047-5_15

J. Kelsey and B. Schneier, Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work, Cramer [Cra05], pp.474-490
DOI : 10.1007/11426639_28
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.116.9667

E. Käsper and P. Schwabe, Faster and Timing-Attack Resistant AES-GCM, Clavier and Gaj [CG09], pp.1-17
DOI : 10.1007/978-3-642-04138-9_1

[. Lai, Higher Order Derivatives and Differential Cryptanalysis, Communications and Cryptography, pp.227-233, 1994.
DOI : 10.1007/978-1-4615-2694-0_23

H. Jacobus and . Van-lint, Introduction to Coding Theory, Graduate Texts in Mathematics, vol.86, 1999.

X. Lai, J. L. Massey, and S. Murphy, Markov Ciphers and Differential Cryptanalysis, Lecture Notes in Computer Science, vol.547, issue.91, pp.17-38, 1991.
DOI : 10.1007/3-540-46416-6_2
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.36.2323

G. Leander, B. Minaud, and S. Rønjom, A Generic Approach to Invariant Subspace Attacks: Cryptanalysis of Robin, iSCREAM and Zorro, Oswald and Fischlin [OF15], pp.254-283
DOI : 10.1007/978-3-662-46800-5_11

G. Leander and A. Poschmann, On the Classification of 4 Bit S-Boxes, Lecture Notes in Computer Science, vol.4547, pp.159-176, 2007.
DOI : 10.1007/978-3-540-73074-3_13

[. Landelle and T. Peyrin, Cryptanalysis of Full RIPEMD-128, pp.228-244
DOI : 10.1007/978-3-642-38348-9_14

[. Lucks, A Failure-Friendly Design??Principle for??Hash??Functions, Lecture Notes in Computer Science, vol.3788, pp.474-494, 2005.
DOI : 10.1007/11593447_26
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.91.9598

S. Manuel, Classification and generation of disturbance vectors for collision attacks against SHA-1, Designs, Codes and Cryptography, vol.59, issue.1-3, pp.247-263, 2011.
DOI : 10.1007/s10623-010-9458-9

B. Minaud, P. Derbez, P. Fouque, and P. Karpman, Key-Recovery Attacks on ASASA, Tetsu Iwata Lecture Notes in Computer Science, vol.9453, pp.3-27, 2015.
DOI : 10.1007/978-3-662-48800-3_1
URL : https://hal.archives-ouvertes.fr/hal-01245381

B. Mennink and . Xpx, XPX: Generalized Tweakable Even-Mansour with Improved Security Guarantees, pp.64-94
DOI : 10.1007/978-3-662-53018-4_3

C. Ralph and . Merkle, A Digital Signature Based on a Conventional Encryption Function, CRYPTO '87 (Carl Pomerance, Lecture Notes in Computer Science, vol.293, pp.369-378, 1987.

C. Ralph and . Merkle, One Way Hash Functions and DES, pp.428-446

. Microsoft, SHA-1 Deprecation Update, Microsoft blog, 2015.

K. Minematsu, Parallelizable Rate-1 Authenticated Encryption from Pseudorandom Functions, pp.275-292
DOI : 10.1007/978-3-642-55220-5_16
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.431.9300

. Mozilla, Continuing to Phase Out SHA-1 Certificates, Mozilla Security Blog, 2015.

S. Manuel and T. Peyrin, Collisions on SHA-0 in One Hour, pp.16-35
DOI : 10.1007/978-3-540-71039-4_2
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.412.4652

F. Mendel, N. Pramstaller, C. Rechberger, and V. Rijmen, The Impact of Carries on the Complexity of Collision Attacks on SHA-1, Lecture Notes in Computer Science, vol.4047, pp.278-292, 2006.
DOI : 10.1007/11799313_18

M. Ueli, R. Maurer, C. Renner, and I. Holenstein, Impossibility Results on Reductions, and Applications to the Random Oracle Methodology, Lecture Notes in Computer Science, vol.2951, pp.21-39, 2004.

F. Mendel, V. Rijmen, and M. Schläffer, Collision Attack on 5 Rounds of Gr??stl, Cid and Rechberger [CR15], pp.509-521
DOI : 10.1007/978-3-662-46706-0_26
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.465.6594

F. J. , M. , N. J. , and A. Sloane, The Theory of Error-Correcting Codes, 2006.

O. Luke and . Connor, On the Distribution of Characteristics in Bijective Mappings, J. Cryptology, vol.8, issue.2, pp.67-86, 1995.

B. Preneel, R. Govaerts, and J. Vandewalle, Hash functions based on block ciphers: a synthetic approach, Lecture Notes in Computer Science, vol.773, pp.93-368, 1993.
DOI : 10.1007/3-540-48329-2_31
URL : https://lirias.kuleuven.be/bitstream/123456789/234170/2/article-48.pdf

J. Vincent-rijmen, B. Daemen, A. Preneel, E. Bosselaers, and . De-win, The Cipher SHARK, Gollmann [Gol96], pp.99-111

R. L. Rivest, The MD4 Message Digest Algorithm, Lecture Notes in Computer Science, vol.537, pp.90-303, 1990.
DOI : 10.17487/rfc1320

R. L. Rivest, RFC 1321: The MD5 Message-Digest Algorithm, 1992.
DOI : 10.17487/rfc1321

J. Roué, Analyse de la résistance des chiffrements par blocs aux attaques linéaires et différentielles. (On the resistance of block ciphers to differential and linear cryptanalyses), 2015.

Y. Sasaki and K. Aoki, Finding Preimages in Full MD5 Faster Than Exhaustive Search, Lecture Notes in Computer Science, vol.5479, pp.134-152, 2009.
DOI : 10.1007/11426639_2
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.476.1544

[. Saarinen, Cryptanalysis of Block Ciphers Based on SHA-1 and MD5, Lecture Notes in Computer Science, vol.2887, pp.36-44, 2003.
DOI : 10.1007/978-3-540-39887-5_4

. Saa11, O. Markku-juhani, and . Saarinen, Cryptographic Analysis of All 4 × 4-Bit S-Boxes, Lecture Notes in Computer Science, vol.7118, pp.118-133, 2011.

B. Schneier, When Will We See Collisions for SHA-1?, Schneier on Security, 2012.

[. Sajadieh, M. Dakhilalian, H. Mala, and P. Sepehrdad, Recursive Diffusion Layers for Block Ciphers and Hash Functions, Canteaut [Can12], pp.385-401
DOI : 10.1007/978-3-642-34047-5_22
URL : http://infoscience.epfl.ch/record/176365

K. Saints and C. Heegard, Algebraic-geometric codes and multidimensional cyclic codes: a unified theory and algorithms for decoding using Grobner bases, IEEE Transactions on Information Theory, vol.41, issue.6, pp.1733-1751, 1995.
DOI : 10.1109/18.476246

M. Stevens, P. Karpman, and T. Peyrin, Freestart Collision for Full SHA-1, Lecture Notes in Computer Science, vol.9665, pp.459-483, 2016.
DOI : 10.1007/978-3-662-49890-3_18
URL : https://hal.archives-ouvertes.fr/hal-01251023

[. Suzaki, K. Minematsu, S. Morioka, and E. Kobayashi, TWINE: A Lightweight Block Cipher for Multiple Platforms, pp.339-354
DOI : 10.1007/978-3-642-35999-6_22

M. Stevens, A. Sotirov, J. Appelbaum, A. K. Lenstra, D. Molnar et al., Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate, Halevi [Hal09], pp.55-69
DOI : 10.1007/978-3-642-03356-8_4

M. Stevens, Attacks on Hash Functions and Applications, 2012.

M. Stevens, New Collision Attacks on SHA-1 Based on Optimal Joint Local-Collision Analysis, pp.245-261
DOI : 10.1007/978-3-642-38348-9_15
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.1027.5684

[. Stichtenoth, Algebraic Function Fields and Codes, Graduate Texts in Mathematics, vol.254, 2009.

E. Tromer, D. A. Osvik, and A. Shamir, Efficient Cache Attacks on AES, and Countermeasures, Journal of Cryptology, vol.10, issue.4, pp.37-71, 2010.
DOI : 10.1007/s00145-009-9049-y
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.150.1984

M. Tsfasman, S. Vl?dut, and D. Nogin, Algebraic Geometric Codes: Basic Notions, Mathematical Surveys and Monographs, vol.139, 2007.
DOI : 10.1090/surv/139

M. Ullrich, C. De-cannière, S. Indesteege, Ö. Küçük, N. Mouha et al., Finding Optimal Bitsliced Implementations of 4 × 4-bit S-boxes, 2011.

[. Wu, M. Wang, and W. Wu, Recursive Diffusion Layers for (Lightweight) Block Ciphers and Hash Functions, pp.355-371
DOI : 10.1007/978-3-642-35999-6_23

X. Wang, Y. Lisa-yin, and H. Yu, Finding Collisions in the Full SHA-1, Shoup [Sho05], pp.17-36
DOI : 10.1007/11535218_2

X. Wang, H. Yu, and Y. Lisa-yin, Efficient Collision Search Attacks on SHA-0, Shoup [Sho05], pp.1-16
DOI : 10.1007/11535218_1
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.86.9654

T. Yajima, Y. Iwasaki, Y. Naito, T. Sasaki, N. Shimoyama et al., A strict evaluation method on the number of conditions for the SHA-1 collision search, Proceedings of the 2008 ACM symposium on Information, computer and communications security , ASIACCS '08, pp.10-20, 2008.
DOI : 10.1145/1368310.1368316

Y. Yajima, Y. Sasaki, T. Naito, T. Iwasaki, N. Shimoyama et al., A New Strategy for Finding a Differential Path of SHA-1, Lecture Notes in Computer Science, vol.4586, pp.45-58, 2007.
DOI : 10.1007/978-3-540-73458-1_4

W. Zhang, Z. Bao, D. Lin, V. Rijmen, B. Yang et al., RECTANGLE: ?????????????????????????????????????????????????????????, Science China Information Sciences, vol.41, issue.12, pp.2014-84, 2014.
DOI : 10.1007/s11432-015-5459-7

J. Zhong and X. Lai, Improved preimage attack on one-block MD4, Journal of Systems and Software, vol.85, issue.4, pp.981-994, 2012.
DOI : 10.1016/j.jss.2011.11.1020
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.400.6489

[. Reza, Z. , H. Raddum, M. Henricksen, and E. Dawson, Bit-Pattern Based Integral Attack, pp.363-381