A method for middle meet-in-the-middle preimage attack on a hash function

Abstract

The application discloses a method for middle meet-in-the-middle preimage attack of a hash function, decomposes the whole encryption / hashing operation process of the JH hash function into a plurality of subexpressions, and automatically searches a state matching scheme satisfying a middle meet constraint by using a MILP solver to directly output an executable preimage attack process and complexity estimation. The method is not only applicable to the JH hash function, but also applicable to other hash functions adopting an AES structure, so that the MILP model can adapt to different round numbers and different construction modes of the cryptographic algorithm. By automatic construction and solving of the MILP model, full coverage search of a middle meet path is realized, the dependence on traditional manual analysis and experience judgment is greatly reduced, and the discovery probability and accuracy of the attack route are improved. A high-performance MILP solver can solve a large-scale MILP model within a reasonable time.

Description

Technical Field

[0001] This invention relates to a Meet-in-the-Middle (MitM) preimage attack method for hash functions, belonging to the field of electronic information technology. Background Technology

[0002] Encounter-in-the-middle attacks are classic time-space tradeoff cryptanalysis methods, first proposed by Diffie and Hellman. In recent years, MitM has made continuous progress in sponge structures, AES construction, and AES-like hash functions, resulting in various enhancement techniques and automated modeling tools covering pre-computation, splicing and segmentation, initial structure exploitation, and double authentication, significantly improving the coverage and efficiency of symmetric cryptanalysis. The exploration of automated MitM has evolved into a fully automated MILP modeling and search framework for AES-like hash functions. However, structural differences between different primitives still present barriers to "cross-primitive transfer" and "automated parameterized modeling" in previous methods, necessitating a general method that is structurally configurable, can stably produce high-quality MitM features, and can be directly implemented into preimage attack procedures.

[0003] This type of automated MitM modeling and search technology can be widely used for standardization evaluation and parameter selection. It can be used for the determination and comparison of security boundaries for candidate hash functions, permutation-based primitive construction, and generalized SPN-type primitives, supporting the accumulation of security evidence and the justification of recommendations during the standardization process. For cryptographic libraries and commercial security products (such as operating system cryptographic services, cryptographic middleware, hardware security modules, and security chips), this technology can provide quantifiable preimage attack complexity assessments, providing a basis for security redundancy and performance trade-offs. In resource-constrained IoT and lightweight scenarios, it can evaluate the security boundaries of generalized AES-type lightweight hash or permutation algorithms under power and area constraints, and further guide the selection of key parameters such as S-boxes, MDS layers, and round constants.

[0004] In the algorithm design and engineering implementation cycle, automated MitM can also serve as a "gateway" for security regression and continuous integration, performing rapid regression testing on structural or parameter adjustments to expose potential splicable paths and abnormal matching structures early on. In cross-primitive scheme comparison, configurable modeling enables policy transfer between different systems, such as sponge / parallel sponge, generalized Even-Mansour permutation, and hash functions based on block ciphers, and outputs comparable security metrics. During the hardware prototype (FPGA / ASIC) verification phase, it estimates the attack costs under different pipelining and parallel slicing strategies, determining the minimum number of security rounds and necessary hardening points to meet throughput / latency targets. Simultaneously, when implementation errors occur or compliance reviews are required, it can quickly generate MitM analysis reports for specific implementations, supporting incident response and auditing. In teaching and research, it can construct reproducible experiments and open benchmarks to compare the effectiveness of different modeling strategies such as MILP / SAT / CP and hybrid constraints, reducing the cost of trial and error in research and teaching.

[0005] The JH hash function, which was one of the finalists in the SHA-3 competition, employs a novel compression function structure, similar to the Even-Mansour permutation structure. The permutation function uses a generalized AES structure. The upper-level compression function F8 compresses the 1024-bit hash value and 512-bit message into a 1024-bit output. The internal permutation E8 follows the SPN paradigm of generalized AES, containing a hierarchical structure of round-by-round S-boxes, linear MDS layers, and permutation P. A key feature of the JH compression function is the "half-part connection": eliminating the message yields a linear XOR relationship between the right half of the output and the left half of the input, forming a closed loop that supports MitM matching.

[0006] The shortcomings of existing technologies are mainly reflected in the following aspects:

[0007] 1) Insufficient ability to automatically search for intermediate meeting routes;

[0008] Traditional attack methods rely on manual analysis by experts or methods based on SAT and CP models. When faced with complex state transitions and a large number of constraints, it is difficult to comprehensively search all possible intermediate encounter routes, resulting in low attack efficiency.

[0009] 2) It has high computational complexity and lacks versatility;

[0010] Most current academic work focuses on analyzing a single round function or a subset of rounds, lacking a generalized intermediate encounter search framework that can cover the entire hash algorithm (especially algorithms involving complex multi-round operations).

[0011] 3) Limitations of the application of mixed-integer linear programming (MILP) models in cryptanalysis;

[0012] Although the MILP model has been successfully applied in AES and other linear constraint-based cryptographic algorithms, for hash functions, which simultaneously contain highly nonlinear S-boxes and complex linear transformations, the construction and solution of traditional MILP models often face problems such as the explosion of state variables and the surge in the number of constraints. There is an urgent need to propose new constraint design ideas and objective function setting methods. Summary of the Invention

[0013] The technical objective of this invention is to propose an intermediate encounter preimage attack method for hash functions, which is mainly based on the mixed integer linear programming model, i.e., the MILP model. The aim is to decompose the entire encryption / hash operation process of the JH hash function into several sub-expressions, and use the MILP solver to automatically search for state matching schemes that satisfy the intermediate encounter constraint, directly producing an executable preimage attack process and complexity estimate. Compared to traditional methods that only perform theoretical feature searches, this invention is engineered from the outset for multiple practical application scenarios: In standardized evaluation and parameter selection scenarios, it provides the minimum attack cost and security margin under different round numbers and parameter settings; in cryptographic library and product selection scenarios, it outputs quantifiable preimage / secondary preimage cost evaluation indicators to support performance-security trade-off decisions; in lightweight and IoT scenarios, it constrains the model's time and storage resources, prioritizing the search for intermediate encounter routes with low memory and low online computing overhead; in hardware implementation and acceleration scenarios, it aligns the matching layer and round slices with pipeline / parallel boundaries, facilitating cost calculations on FPGA / ASIC prototypes; in algorithm development scenarios, it serves as a security regression "gatekeeper" to automatically detect joinable paths resulting from structural changes; in event response and compliance auditing scenarios, it is quickly customized to a specific implementation (including constants, permutations, and round function differences), outputting reproducible attack reports and complexity upper bounds. Specifically, it includes the following steps:

[0014] 1) Overview of MILP model construction;

[0015] To adapt to different application scenarios, scenario-based configuration parameters are introduced at the entry point of the mixed-integer linear programming model (MILP) model construction, including: target safety strength threshold (e.g., 2). k The MILP model considers factors such as time / memory budget (level of complexity), allowed online / offline complexity ratio, available storage limit, number of rounds and candidate matching layer positions, allowed matching types (full-state matching / half-state matching / matching with linear relationships), and implementation constraints in hardware / lightweight scenarios (e.g., aligning certain round boundaries or limiting parallelism). The MILP model models the data states of each round in the hash function using state units as the basic unit, linearizes the S-box, row shifting, and column mixing operations for each round, and designs corresponding constraint expressions. The MILP model includes the following parts:

[0016] State variable definition: Construct state variables for the forward and reverse paths, representing bit information propagated from the initial state and the target state to the middle, respectively.

[0017] Constraint settings: Establish linear inequality constraints for each round of operations. For nonlinear S-boxes, use piecewise linearization techniques. For row shifting and column mixed operations, construct linear constraints directly.

[0018] Input / output conditions: Set input / output constraints for the initial and target states to ensure that the data states on both sides satisfy the predetermined differential characteristics or preimage conditions.

[0019] Objective function design: The objective function aims to minimize the overall complexity of the attack by maximizing the degrees of freedom to reduce the burden of exhaustive search in actual preimage attacks.

[0020] Standardized evaluation scenarios typically aim for "minimum number of breakable rounds / maximum number of attackable rounds given resources"; lightweight scenarios place higher weight on memory; and hardware scenarios assign higher weight to matching layer alignment and parallelism penalty terms.

[0021] 2) Design of state variables and constraints;

[0022] In the MILP model, the state variables are first constructed using 4 bits as the basic unit, and the forward and reverse states are defined:

[0023] a) Representation of state variables;

[0024] Let the positive state be X, and let the variables be X0, X1, ..., X2. n-1 Represented by: the reverse state is Y, defined by variables Y0, Y1, ..., Y... n-1 This indicates that each variable depends on the result of the previous round of operations. By defining binary variables and auxiliary integer variables, the nonlinear operations in the S-box are transformed into a series of linear constraints.

[0025] b) Operational constraint modeling;

[0026] S-box operation constraints: If the S-box is public, then its input-output relationship is deterministic. This deterministic relationship is directly transmitted in the model, and there is no need to constrain the S-box operations.

[0027] Row shift and column hybrid constraints: Linear operations are described by simple variable rearrangement or matrix transformations with fixed coefficients, thus forming linear equality or inequality constraints.

[0028] Matching constraints: Set matching constraints in the intermediate layer, that is, the forward path and the reverse path must have the same state variable value or satisfy a specific relationship at a specified number of rounds.

[0029] c) Input / output conditions;

[0030] Initial state constraints: Input messages are initialized using a pre-defined pattern. State bits are categorized into three types based on their functional attributes: free bits, fixed bits, and unresolved bits. Free bits are bits that can be assigned by attackers to increase the degree of freedom in matching. They can be further subdivided into offline free bits (used for pre-computed dictionaries, rainbow tables, etc.) and online free bits (used for fast searching in the online phase) depending on the implementation strategy. Fixed bits are determined by the algorithm specification, initial chain value, length encoding, known prefix / salt value, or implementation.

[0031] Target State Constraints: During backpropagation, the target state must satisfy boundary conditions consistent with the preimage target to ensure that the forward and reverse paths can be correctly matched and closed into an executable preimage route in the intermediate layer. Specific preimage conditions include: Full preimage condition, which requires that the output of the final round of the compression function, after being mapped by the JH specification (including the final round linear layer, necessary transposition / constant XOR, and truncation), is bit-by-bit equal to the given target hash value; Mask preimage condition, which applies equality constraints only to the output bits at specified mask positions, used for scenarios such as prefix / suffix binding, salting, or fixed protocol fields; Linear relation preimage condition, which applies a set of modulo-2 linear equations to the output state to express the parity bit, parity constraints, or alignment with pipelined / parallel slices. For instances with multiple messages or variable output lengths, further constraints need to be applied to block boundary consistency and truncation positions. For example, in JH-512, the high 512 bits of the 1024-bit state of the final round after output mapping are required to equal the target value, while in JH-256, the corresponding high 256 bits are required to equal the target value. Regarding scenario selection: standardized evaluation typically employs full preimage conditions to obtain the tightest upper bound on complexity; lightweight and IoT scenarios prioritize masking or partial matching to reduce online computation and memory pressure; hardware implementation scenarios prioritize linear relationships aligned with register slice / pipeline boundaries, facilitating direct mapping of inverse boundary conditions to FPGA / ASIC implementations. These target state constraints, along with intermediate layer matching constraints (such as the linear XOR relationship induced by JH's half-connections), work together to ensure a minimum complexity solution satisfying the preimage objective is obtained given resource and implementation constraints.

[0032] d) Setting the objective function;

[0033] Set the objective function Obj T Let max{min{DoB,DoR,DoM}}, where DoB and DoR represent the degrees of freedom of the forward and reverse paths, and DoM represents the degrees of freedom of the intermediate meeting and matching; the goal is to maximize the lower bound of this value, so as to minimize the attack complexity while ensuring that the constraints are satisfied.

[0034] 3) Attack steps and implementation process;

[0035] The overall process of the intermediate encounter preimage attack method based on the MILP model is as follows:

[0036] a) Preprocessing and model building;

[0037] Input the target hash value T, and construct the MILP model based on the structure of the JH hash function and the known initial difference.

[0038] State variables and operational constraints are established for the forward and backward propagation paths, and matching constraints are set in the intermediate layer to ensure consistency of intermediate states.

[0039] b) Solved using the MILP solver;

[0040] A high-efficiency solver is used to solve the MILP model, searching for the optimal solution that satisfies all constraints. The solution result represents the intermediate meeting route, and the assignment schemes for the forward and reverse state variables are provided.

[0041] Based on the model's solution results, the minimum degree of freedom is automatically obtained, and the corresponding attack complexity is evaluated.

[0042] c) Path construction and matching;

[0043] Based on the solution results, forward propagation paths and backward propagation paths are constructed and compared in the intermediate layer to ensure that the matching state meets the preset conditions.

[0044] If a match is found, the corresponding message preimage is recorded; otherwise, the MILP model parameters are adjusted and the solution is obtained again.

[0045] d) Preimage attack verification;

[0046] Using the obtained intermediate meeting scheme, a complete message is constructed and its hash value is calculated through forward and backward computations.

[0047] Verify whether the message meets the requirements of the target hash value T, thus completing the preimage attack.

[0048] Compared with the prior art, the present invention has the following significant advantages:

[0049] 1) High versatility;

[0050] This method is applicable not only to JH hash functions, but also to other hash functions that adopt AES-like structures, enabling the MILP model to adapt to cryptographic algorithms with different rounds and different construction modes.

[0051] 2) High level of automation;

[0052] By automatically constructing and solving the MILP model, a full-coverage search of intermediate encounter paths is achieved, which greatly reduces the reliance on traditional manual analysis and experience-based judgment, and improves the probability and accuracy of attack route discovery.

[0053] 3) Efficient solution;

[0054] High-performance MILP solvers, such as Gurobi, can solve large-scale MILP models in a reasonable amount of time, even in 13 or more rounds, and find the optimal solution that satisfies all constraints.

[0055] 4) Accuracy and systematicity;

[0056] All state variables and constraints in the model are described by linear inequalities, and the solution results mathematically satisfy the intermediate meeting requirement, thus ensuring that the message obtained by the actual preimage attack can accurately match the target hash value.

[0057] 5) Scalability;

[0058] The framework of this method is highly scalable. When hardware computing power is improved or new types of hash functions emerge, the number of state variables and constraints can be directly adjusted to achieve attack detection for more rounds or even the entire function. Attached Figure Description

[0059] Figure 1 The framework for an intermediate encounter preimage attack against the JH-512 algorithm is presented. Detailed Implementation

[0060] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0061] The technical solution adopted in this invention is: an intermediate encounter preimage attack method for AES / Even-Mansour type structure hash functions, which provides a unified approach to automated MILP modeling and matching kernel construction, and demonstrates the feasibility and transferability of the method by taking the 13-round preimage attack of JH-512 as an example.

[0062] This invention proposes an intermediate encounter preimage attack method for hash functions, primarily based on the MILP model. The aim is to decompose the entire encryption / hash operation process of the JH hash function into several sub-expressions and automatically search for state matching schemes that satisfy the intermediate encounter constraint using the MILP solver. The specific technical solution includes the following steps:

[0063] 4) Overview of MILP Model Construction

[0064] The core idea of ​​building a MILP model is to model the data states of each round in the hash function using state units as the basic unit, linearize the S-box, row shifting, and column mixing operations in each round, and design corresponding constraint expressions. The model mainly includes the following parts:

[0065] State variable definition: Construct state variables for the forward path (blue path) and the reverse path (red path), which represent the bit information propagated from the initial state and the target state to the middle, respectively.

[0066] Constraint settings: Establish linear inequality constraints for each round of operations. For nonlinear S-boxes, use piecewise linearization techniques. For row shifting and column mixed operations, construct linear constraints directly.

[0067] Input / output conditions: Set input / output constraints for the initial and target states to ensure that the data states on both sides satisfy the predetermined differential characteristics or preimage conditions.

[0068] Objective function design: The objective function aims to minimize the overall complexity of the attack by maximizing the degrees of freedom (such as the lower bound of the free values ​​of blue, red, and matching variables) to reduce the burden of exhaustive search in actual preimage attacks.

[0069] The MILP model of this invention is not only applicable to JH hash function instances, but also has good scalability and can adapt to cases with more rounds.

[0070] 5) Design of state variables and constraints

[0071] In the MILP model, we first construct state variables using 4 bits as the basic unit, defining the forward (blue path) and reverse (red path) states:

[0072] e) State variable representation

[0073] Let the positive state be X (given by variables X0, X1, ..., X...). n-1 (represented by), the reverse state is Y (given by variables Y0, Y1, ..., Y). n-1 (represented by the S-box), where each variable depends on the result of the previous round of operations. By defining binary variables and auxiliary integer variables, the nonlinear operations in the S-box can be transformed into a series of linear constraints.

[0074] f) Operational constraint modeling

[0075] S-box operation constraints: Assuming the S-box is public, its input-output relationship is deterministic, and this deterministic relationship can be directly passed in the model. Therefore, there is no need to constrain the S-box operations.

[0076] Row shift and column hybrid constraints: These linear operations are described by simple variable rearrangement or matrix transformations with fixed coefficients, thus forming linear equality or inequality constraints.

[0077] Matching Constraint (Meet in the Middle): A matching constraint is set in the intermediate layer, meaning that the forward and reverse paths must have the same state variable value or satisfy a specific relationship at a specified number of rounds. This constraint is key to implementing a meet-in-the-middle attack.

[0078] g) Input / output conditions

[0079] Initial state constraints: The input message is initialized through a pre-defined pattern (a combination of blue and red variables), where blue / red variables represent the free bits actively selected in the message, gray variables represent the bits that are always determined during propagation, and white variables are undetermined bits.

[0080] Target state constraints: In backpropagation, the target state must meet specific preimage conditions (e.g., a certain part of the state must be a fixed value or satisfy a linear relationship) to ensure that the forward and backward paths can be correctly matched in the intermediate layer.

[0081] h) Objective function setting Obj T The expression is max{min{DoB,DoR,DoM}}, where DoB and DoR are values ​​of 0.

[0082] Set the objective function Obj T Let max{min{DoB,DoR,DoM}}, where DoB and DoR represent the degrees of freedom of the forward and reverse paths, and DoM represents the degrees of freedom of the intermediate meeting and matching. The goal is to maximize the lower bound of this value, so as to minimize the attack complexity while ensuring that the constraints are satisfied.

[0083] 6) Attack steps and implementation process

[0084] The overall process of the intermediate encounter preimage attack method based on the MILP model is as follows:

[0085] e) Preprocessing and Model Building

[0086] Input the target hash value T, and construct the MILP model based on the structure of the JH hash function and the known initial difference.

[0087] State variables and operational constraints are established for the forward and backward propagation paths, and matching constraints are set in the intermediate layer to ensure consistency of intermediate states.

[0088] f) Solving with MILP solver

[0089] The MILP model is solved using an efficient solver (such as Gurobi) to search for the optimal solution that satisfies all constraints. The solution obtained in this process represents the intermediate meeting route, and the assignment schemes for the forward and reverse state variables are provided.

[0090] Based on the model's solution results, the minimum degree of freedom is automatically obtained, and the corresponding attack complexity is evaluated.

[0091] g) Path construction and matching

[0092] Based on the solution results, a forward propagation path (blue path) and a backward propagation path (red path) are constructed, and a comparison is performed in the intermediate layer to ensure that the matching state meets the preset conditions.

[0093] If a match is found, the corresponding message preimage is recorded; otherwise, the MILP model parameters are adjusted and the solution is obtained again.

[0094] h) Preimage attack verification

[0095] Using the obtained intermediate meeting scheme, a complete message is constructed and its hash value is calculated through forward and backward computations.

[0096] Verify whether the message meets the requirements of the target hash value T, thus completing the preimage attack.

[0097] Example

[0098] An example for JH-512 is given, and it is explained how to migrate to other similar hash functions.

[0099] 1) Key points of the original text structure

[0100] a) Compression function The input consists of a 1024-bit hash value and a 512-bit message; the output is a new 1024-bit hash value, internally involving a permutation function. ; express enter, express Output, satisfying , Delete the message It connects the left half input and the right half output, providing an identity for the matching kernel.

[0101] b) Replacement It operates according to the SPN paradigm, with a total of 6(d−1) rounds (d=8). Each round includes an S-box, a linear MDS layer L, and a permutation P. The S-box is selected by constant bits as either S0 or S1, and L is... The MDS transformation on P is a fixed byte / half-word substitution.

[0102] Figure 1This is the framework diagram of the JH-512 algorithm's encounter-in-the-middle preimage attack.

[0103] 2) MILP Modeling and Optimal Features

[0104] Using 2-bit color encoding and propagation / matching linear constraints, a 13-round MitM feature is obtained through Gurobi search, resulting in DoB=DoR=48 and DoM=64. The corresponding attack complexity is... , where 128 is the column number and 4 is the number of bits converted according to the nibble granularity.

[0105] 3) The matching kernel meets the middle.

[0106] Using the inverse mapping of P and the linear layer constraints, a one-dimensional equivalent matching is performed on the left and right branches at the input of the 12th round of the linear layer:

[0107]

[0108] 4) Attack Flow (Summary)

[0109] a) Select the value range of 128 free gray nibble;

[0110] b) For the blue / red branches respectively Each of the above selections The nibble enumeration is used to advance to the 13th round of the linear layer input coexistence table;

[0111] c) Calculation Perform column matching on the two tables to satisfy the following conditions: The equation hits;

[0112] d) Backfilling ,through The entire process calculates the digest and compares it with the target digest; if successful, the original image is obtained.

[0113] This embodiment does not threaten the complete JH, but demonstrates a new perspective and feasible path for constructing high-quality MitM features and implementing preimage attacks in AES / Even-Mansour-like structures; the selection of the initial configuration "right half gray / left half colored", the granularity selection and the linear layer convex hull constraints can all be automatically generated, which facilitates batch evaluation of different rounds / parameters.

Claims

1. A method for attacking the intermediate encounter preimage of a hash function, characterized in that: The entire encryption / hash operation process of the JH hash function is decomposed into several sub-expressions, and the MILP solver is used to automatically search for state matching schemes that satisfy the intermediate encounter constraint, directly producing an executable preimage attack process and complexity estimate; it is engineered to suit multiple practical application scenarios: in the scenario of standardized evaluation and parameter selection, it is used to give the minimum attack cost and security margin under different rounds and parameter settings; in the scenario of cryptographic library and product selection, it outputs quantifiable preimage / secondary preimage cost evaluation indicators to support performance-security trade-off decisions; In lightweight and IoT scenarios, constrain the model's time and storage resources, and prioritize searching for intermediate encounter routes with low memory and low online computing overhead; in hardware implementation and acceleration scenarios, align the matching layer and wheel slice with the pipeline / parallel boundary to facilitate cost calculation on FPGA / ASIC prototypes. In algorithm development scenarios, it serves as a secure regression "access control" system that automatically detects structural changes that result in concatenable paths; in incident response and compliance auditing scenarios, it can be quickly customized to specific implementations, outputting reproducible attack reports and upper bounds on complexity.

2. The method for attacking intermediate encounter preimages of a hash function according to claim 1, characterized in that: This method specifically includes the following steps: 1) Overview of MILP model construction; To adapt to different application scenarios, scenario-based configuration parameters are introduced at the entry point of the Mixed Integer Linear Programming (MILP) model construction, including: target security strength threshold, allowed online / offline complexity ratio, available storage limit, number of rounds and candidate set of matching layer positions, allowed matching types, and implementation constraints in hardware / lightweight scenarios; the MILP model models the data state of each round in the hash function as the basic unit of state unit, linearizes the S-box, row shift, and column hybrid operations of each round, and designs corresponding constraint expressions; 2) Design of state variables and constraints; In the MILP model, the state variables are first constructed using 4 bits as the basic unit, and the forward and reverse states are defined: a) Representation of state variables; Let the positive state be X, and let the variables be X0, X1, ..., X2. n-1 Represented by: the reverse state is Y, defined by variables Y0, Y1, ..., Y... n-1 This indicates that each variable depends on the result of the previous round of operations; by defining binary variables and auxiliary integer variables, the nonlinear operations in the S-box are transformed into a series of linear constraints; b) Operational constraint modeling; S-box operation constraints: If the S-box is public, then its input-output relationship is determined, and no constraints are imposed on the S-box operation; Row shift and column hybrid constraints: Linear operations are described by rearranging variables or matrix transformations with fixed coefficients, forming linear equality or inequality constraints; Matching constraints: Set matching constraints in the intermediate layer, that is, the forward path and the reverse path must have the same state variable value or satisfy a specific relationship at a specified number of rounds; c) Input / output conditions; Initial state constraints: Input messages are initialized through a pre-defined pattern. State bits are divided into three categories according to their functional attributes: free bits, fixed bits, and unresolved bits. Free bits are bits assigned by attackers to increase the degree of freedom in matching, and are further subdivided into offline free bits and online free bits according to the implementation strategy. Fixed bits are determined by algorithm specifications, initial chain values, length encoding, known prefixes / salt values, or implementation. Target state constraints: During backpropagation, the target state must satisfy the same boundary conditions as the original image target to ensure that the forward and reverse paths can be correctly matched and closed in the intermediate layer to form an executable original image route; d) Setting the objective function; Set the objective function Obj T Let max{min{DoB,DoR,DoM}}, where DoB and DoR represent the degrees of freedom of the forward and reverse paths, and DoM represents the degrees of freedom of the intermediate meeting and matching; the goal is to maximize the lower bound of this value, so as to minimize the attack complexity while ensuring that the constraints are satisfied. 3) Attack steps and implementation process; The overall process of the intermediate encounter preimage attack method based on the MILP model is as follows: a) Preprocessing and model building; Input the target hash value T, and construct the MILP model based on the structure of the JH hash function and the known initial difference; State variables and operational constraints are established for the forward and backward propagation paths, and matching constraints are set in the intermediate layer to ensure consistency of intermediate states. b) Solved using the MILP solver; The MILP model is solved using an efficient solver to search for the optimal solution that satisfies all constraints. The solution result is the intermediate meeting route, and the assignment schemes for the positive and negative state variables are given. Based on the model's solution results, the minimum degree of freedom is automatically obtained, and the corresponding attack complexity is evaluated. c) Path construction and matching; Based on the solution results, forward propagation path and backward propagation path are constructed, and comparison is performed in the intermediate layer to ensure that the matching state meets the preset conditions. If a match is found, the corresponding message preimage is recorded; otherwise, the MILP model parameters are adjusted and the solution is obtained again. d) Preimage attack verification; Using the obtained intermediate encounter scheme, a complete message is constructed and its hash value is calculated through forward and backward computations; the message is then verified to meet the requirements of the target hash value T, thus completing the preimage attack.

3. The method for attacking intermediate encounter preimages of a hash function according to claim 2, characterized in that: The MILP model comprises the following parts: State variable definition: Construct the state variables for the forward and reverse paths, representing the bit information propagated from the initial state and the target state to the middle, respectively; Constraint settings: Establish linear inequality constraints for each round of operations. For nonlinear S-boxes, use piecewise linearization techniques. For row shifting and column mixed operations, directly construct linear constraints. Input / output conditions: Set input / output constraints for the initial state and the target state to ensure that the data states on both sides satisfy the predetermined difference characteristics or preimage conditions; Objective function design: The objective function aims to minimize the overall complexity of the attack by maximizing the degrees of freedom to reduce the burden of exhaustive search in actual preimage attacks; Standardized evaluation scenarios typically target "minimum number of breakable rounds / maximum number of attackable rounds given resources"; Lightweight scenarios place a higher emphasis on memory usage; Hardware scenarios assign higher weights to the alignment of the matching layer and the parallelism penalty term.

4. The method for attacking intermediate encounter preimages of a hash function according to claim 2, characterized in that: The specific preimage conditions in the target state constraints include: full preimage conditions, which require that the output of the last round of the compression function, after being mapped by the JH specification, is bit-wise equal to the given target hash value; mask preimage conditions, which apply equality constraints only to the output bits at specified mask positions, used for prefix / suffix binding, salting, or protocol field fixing; and linear relationship preimage conditions, which apply a set of modulo 2 linear equations to the output state to express the parity bit, parity constraints, or the relationship aligned with pipeline / parallel slices. In terms of scenario selection: standardized evaluation usually uses full preimage conditions to obtain the tightest upper bound of complexity; lightweight and IoT scenarios preferentially use mask or partial matching to reduce online computation and memory pressure; hardware implementation scenarios preferentially choose linear relationships aligned with register slice / pipeline boundaries, which facilitates direct mapping of inverse boundary conditions to FPGA / ASIC implementations; the target state constraints and the matching constraints of the intermediate layer work together to ensure that the minimum complexity solution that satisfies the preimage target is obtained under given resource and implementation constraints.

Images