Chapter 4 Cryptographic Hash Functions 1 Outline n

Chapter 4 Cryptographic Hash Functions 1

Outline n n n 4. 1 4. 2 4. 3 4. 4 4. 5 Hash Functions and Data Integrity Security of Hash Functions Iterated Hash Functions Message Authentication Codes Unconditionally Secure MACs 2

4. 1 Hash Functions and Data Integrity n n A cryptographic hash function can provide assurance of data integrity. ex: (x, y) Alice Bob can verify if y = h. K(x) h is a hash function x is a message y is the authentication tag (message digest) K is key n 3

Hash Functions and Data Integrity n Definition 4. 1: A hash family is a four-tuple (X, Y, K, H), where the following condition are satisfied: n 1 X is a set of possible messages n 2 Y is a finite set of possible message digests or authentication tags n 3 K, the keyspace, is a finite set of possible keys n 4 For each K K, there is a hash function h. K H. Each hk: X Y 4

Hash Functions and Data Integrity n n h is compress functions n X is a finite set n Y is a finite set n |X | |Y | or stronger, |X | 2|Y | A pair (x , y) X Y is said to be valid under the key K n h. K(x) = y. Let FX, Y denote the set of all function from X to Y. n |X| = N and |Y| = M. X, Y| = MN. n |F X, Y is termed an (N, M)-hash family. n F F An unkeyed hash function is a function n h: X Y 5

4. 2 Security of Hash Functions n If a hash function is to be considered secure, these three problems are difficult to solve n Problem 4. 1: Preimage n Instance: A hash function h: X Y and an element y Y. n Find: x X such that f(x) = y n Problem 4. 2: Second Preimage n Instance: A hash function h: X Y and an element x X n Find: x’ X such that x’ ≠ x and h(x’) = h(x) n Problem 4. 3: Collision n Instance: A hash function h: X Y. n Find: x, x’ X such that x’ ≠ x and h(x’) = h(x) 6

Security of Hash Functions n n n A hash function for which Preimage cannot be efficiently solved is often said to be one-way or preimage resistant. A hash function for which Second Preimage cannot be efficiently solved is often said to be second preimage resistant. A hash function for which Collision cannot be efficiently solved is often said to be collision resistant. 7

Security of Hash Functions n 4. 2. 1 The Random Oracle Model n n The random oracle model provides a mathematical model of an “ideal” hash function. In this model, a hash function h: X Y is chosen randomly from FX, Y n n The only way to compute a value h(x) is to query the oracle. THEOREM 4. 1 Suppose that h FX, Y is chosen randomly, and let X 0 X. Suppose that the values h(x) have been determined (by querying an oracle for h) if and only if x X 0. Then Pr[h(x)=y] = 1/M for all x X X 0 and all y Y. 8

Security of Hash Functions n 4. 2. 2 Algorithms in the Random Oracle Model n n n Randomized algorithms make random choices during their execution. A Las Vegas algorithm is a randomized algorithm n may fail to give an answer n if the algorithm does return an answer, then the answer must be correct. A randomized algorithm has average-case success probability ε if the probability that the algorithm returns a correct answer, averaged over all problem instances of a specified size , is at least ε (0≤ε<1). 9

Security of Hash Functions n n We use the terminology (ε, q)-algorithm to denote a Las Vegas algorithm with average-case success probability ε n the number of oracle queries made by algorithms is at most q. Algorithm 4. 1: FIND PREIMAGE (h, y, q) n choose any X 0 X, |X 0| = q n for each x X 0 do if h(x) = y then return (x) n return (failure) 10

Security of Hash Functions n THEOREM 4. 2 For any X 0 X with |X 0| = q, the average-case success probability of Algorithm 4. 1 is ε=1 - (1 -1/M)q. n proof Let y Y be fixed. Let Χ 0 = {x 1, x. . , xq}. For 1 ≤ i ≤ q, let Ei denote the event “h(xi) = y”. From Theorem 4. 1 that the Ei’s are independent events, and Pr[Ei] = 1/M for all 1 ≤ i ≤ q. Therefore The success probability of Algorithm 4. 1, for any fixed y, is constant. Therefore, the success probability averaged over all y Y is identical, too. 11

Security of Hash Functions n n Algorithm 4. 2: FIND SECOND PREIMAGE (h, x, q) n y h(x) n choose X 0 X {x}, |X 0| = q - 1 n for each x 0 X 0 do if h(x 0) = y then return (x 0) n return (failure) THEOREM 4. 3 For any X 0 X {x} with |X 0| = q - 1, the success probability of Algorithm 4. 2 is ε= 1 - (1 1/M)q-1. 12

Security of Hash Functions n Algorithm 4. 3: FIND COLLISION (h, q) n choose X 0 X , |X 0 | = q n for each x X 0 do yx h(x) n if yx = yx’ for some x’ ≠ x then return (x, x’) n else return (failure) 13

Security of Hash Functions n n Birthday paradox n In a group of 23 randomly chosen people, at least two will share a birthday with probability at least ½. n Finding two people with the same birthday is the same thing as finding a collision for this particular hash function. n ex: Algorithm 4. 3 has success probability at least ½ when q = 23 and M = 365 Algorithm 4. 3 is analogous to throwing q balls randomly into M bins and then checking to see if some bin contains at least two balls. 14

Security of Hash Functions n THEOREM 4. 4 For any X 0 X with |X 0| = q, the success probability of Algorithm 4. 3 is n proof Let X 0 = {x 1, . . , xq}. Ei : the event “h(xi) {h(x 1), . . , h(xi-1)}. ” , 2 i q Using induction, from Theorem 4. 1 that Pr[E 1] = 1 and for 2 ≤ i ≤ q. 15

Security of Hash Functions x is small 1 -x e-x n n The probability of finding no collision is ε denotes the probability of finding at least one collision n Ignore –q, ε= 0. 5, q ≈ 1. 17 Take M = 365, we get q ≈ 22. 3 16

Security of Hash Functions n n This says that hashing just over random elements of X yields a collision with a prob. of 50%. A different choice of εleads to a different constant factor, but q will still be proportional to. So this algorithm is a (1/2, O( ))-algorithm. 17

Security of Hash Functions n n The birthday attack imposes a lower bound on the size of secure message digests. A 40 -bit message digest would be very in secure, since a collision could be found with prob. ½ with just over 2^20 (about a million) random hashes. It is usually suggested that the minimum acceptable size of a message digest is 128 bits (the birthday attack will require over 2^64 hashes in this case). In fact, a 160 -bit message digest (or larger) is usually recommended. 18

Security of Hash Functions n 4. 2. 3 Comparison of Security Criteria n n In the random oracle model, solving Collision is easier than solving Preimage of Second Preimage. Whethere exist reductions among these three problems which could be applied to arbitrary hash functions? (Yes. ) Reduce Collision to Second Preimage using Algorithm 4. 4. Reduce Collision to Preimage using Algorithm 4. 5. 19

Security of Hash Functions n Algorithm 4. 4: COLLISION TO SECOND PREIMAGE (h) n n external ORACLE 2 NDPREIMAGE choose x X uniformly at random if (ORACLE 2 NDPREIMAGE(h, x) = x’) (!error here in the text) then return (x, x’) else return (failure) 20

Security of Hash Functions n n Suppose that ORACLE 2 NDPREIMAGE is an (ε, q)-algorithm that solves Second Preimage for a particular, fixed hash function h. Then COLLISIONTOSECONDPREIMAGE is an (ε, q)-algorithm(!error here in text) that solves Collision for the same hash function h. As a consequence of this reduction, collision resistance implies second preimage resistance. 21

Security of Hash Functions n Algorithm 4. 5: COLLISION TO PREIMAGE (h) n external ORACLEPREIMAGE n choose x X uniformly at random n y h(x) n if (ORACLEPREIMAGE(h, y) = x’) and (x’ x) then return (x, x’) n else return (failure) 22

Security of Hash Functions n THEOREM 4. 5 Suppose h: X Y is a hash function where |X| and |Y | are finite and |X| 2|Y |. Suppose ORACLEPREIMAGE is a (1, q) algorithm for Preimage, for the fixed hash function h. (and so h is surjective(onto)) Then COLLISION TO PREIMAGE is a (1/2, q+1) algorithm for Collision, for the fixed hash function h. 23

Security of Hash Functions n proof For any x X, define equivalence class C : [x]= {x 1 X : h(x) = h(x 1)} (see text for detailed notation) Given the element x X, the probability of success is (|[x]| - 1) / |[x]| in ORACLEPREIMAGE. The probability of success of algorithm COLLISION TO PREIMAGE is (average) 24

4. 3 Iterated Hash Function n Compression function: hash function with a finite domain A hash function with an infinite domain can be constructed by the mapping method of a compression function is called an iterated hash function. We restrict our attention to hash functions whose inputs and outputs are bitstrings (i. e. , strings formed of 0 s and 1 s). 25

4. 3 Iterated Hash Function n Iterated hash function h: Suppose that compress: {0, 1}m+t {0, 1}m is a compression function ( where t 1). n Preprocessing n given x (|x| m + t + 1) n construct y = x || pad(x) such that |y| 0 (mod t) y = y 1 || y 2 ||…|| yr, where |yi| = t for 1 i r n pad(x) is constructed from x using a padding function. n the mapping x -> y must be an injection (1 to 1) 26

Iterated Hash Function n n Processing n IV is a public initial value which is a bitstring of length m. n z 0 IV compress function: n z 1 compress(z 0 || y 1) {0, 1}m+t {0, 1}m (t 1) n …. n zr compress(zr-1 || yr) Optional output transformation m l n g: {0, 1} n h(x) = g(zr) 27

Iterated Hash Function n 4. 3. 1 The Merkle-Damgard Construction n Algorithm 4. 6: MERKLE-DAMGARD(x) n external compress m+t {0, 1}m, n comment: compress: {0, 1} where t 2 n n |x| n k n/(t - 1) n d n - k(t - 1) n for i 1 to k - 1 do yi xi 28

Iterated Hash Function n n n yk xk || 0 d yk+1 the binary representation of d z 1 0 m+1 || y 1 g 1 compress(z 1) for i 1 to k do zi+1 gi || 1 || yi+1 gi+1 compress(zi+1) h(x) gk+1 return (h(x)) 29

Iterated Hash Function n n THEOREM 4. 6 Suppose compress : {0, 1}m+t {0, 1}m is a collision resistant compression function, where t 2. Then the function as constructed in Algorithm 4. 6, is a collision resistant hash function. proof Suppose that we can find x x’ such that h(x)= h(x’). y(x) = y 1 || y 2 ||. . || yk+1, x is padded with d 0’s y(x’) = y’ 1 || y’ 2 ||. . || y’l+1 , x’ is padded with d’ 0’s g-values : g 1, . . , gk+1 or g’ 1, . . , g’l+1 30

Iterated Hash Function n case 1: |x| ! |x’| (mod t - 1) d d’ and yk+1 y’l+1 compress(gk || 1 || yk+1) = gk+1= h(x) = h(x’) = g’l+1 = compress (g’l || 1 || y’l+1), which is a collision for compress because yk+1 y’l+1 case 2: |x| |x’| (mod t - 1) case 2. a: |x| = |x’| k = l and yk+1 = y’k+1 compress(gk || 1 || yk+1) = gk+1 = h(x) = h(x’) = g’k+1 = compress (g’k || 1 || y’k+1) If gk g’k, then we find a collision for compress, so assume gk = g’k. 31

Iterated Hash Function compress(gk-1 ||yk) = gk = g’k = compress (g’k-1 || y’k) Either we find a collision for compress, or gk-1 = g’k-1 and yk = y’k. Assuming we do not find a collision, we continue work backwards, until finally we obtain compress(0 m+1 || y 1) = g 1 = g’ 1 = compress (0 m+1||y’ 1) If yk y’k, then we find a collision for compress, so we assume y 1 = y’ 1. But then yi = y’i for 1 i k+1, so y(x) = y(x’). 32

Iterated Hash Function n n This implies x = x’, because the mapping x y(x) is an injection. We assume x x’, so we have a contradiction. case 2 b: |x| |x’| Assume |x’| > |x|, so l > k Assuming we find no collisions for compress, we reach the situation where compress(0 m+1 || y 1) = g 1 = g’l-k+1 = compress (g’l-k || 1 || y’l-k+1). But the (m+1)st bit of 0 m+1 || y 1 is a 0 and the (m+1)st bit of g’l-k || 1 || y’l-k+1 is a 1. So we find a collision for compress. 33

Iterated Hash Function n Algorithm 4. 7: MERKLE-DAMGARD 2(x) (t = 1) n external compress m+1 {0, 1}m n comment: compress: {0, 1} n n |x| f(0)=0 f(1)=01 n y 11 || f(x 1) || f(x 2) ||… || f(xn) denote y = y 1 || y 2 ||…|| yk, where yi {0, 1}, 1 i k m n g 1 compress(0 || y 1) n for i 1 to k - 1 do gi+1 compress(gi || yi+1) n return (gk) 34

Iterated Hash Function n The encoding x y = y(x), as defined algorithm 4. 7 satisfies two important properties: n If x x’, then y(x) y(x’) (i. e. x y = y(x) is an injection) n There do not exist two strings x x’ and a string z such that y(x) = z || y(x’) (i. e. no encoding is a postfix of another encoding) 35

Iterated Hash Function n n THEOREM 4. 7 Suppose compress : {0, 1}m+1 : {0, 1}m is a collision resistant compression function. Then the function as constructed in Algorithm 4. 7, is a collision resistant hash function. proof Suppose that we can find x x’ such that h(x) = h(x’). Denote y(x) = y 1 y 2…yk and y(x’) = y’ 1 y’ 2…y’l case 1: k = l As in Theorem 4. 6, either we find a collision for compress, or we obtain y = y’. But this implies x = x’, a contradiction. 36

Iterated Hash Function case 2: k l Without loss of generality, assume l > k Assuming we find no collision for compress, we have following sequence of equalities: yk = y’l yk-1 = y’l-1 …… y 1 = y’l-k+1 But this contradicts the “postfix-free” property We conclude that h is collision resistant. 37

Iterated Hash Function n THEOREM 4. 8 Suppose compress: {0, 1}m+t {0, 1}m is a collision resistant compression function, where t 1. Then there exists a collision resistant hash function The number of times compress is computed in the evaluation of h is at most if t 2 2 n+2 if t = 1 where |x| = n. 38

Iterated Hash Function n 4. 3. 2 The Secure Hash algorithm n SHA-1(Secure Hash Algorithm) n iterated hash function n 160 -bit message digest n word-oriented (32 bit) operation on bitstrings n Operations used in SHA-1 n X Y bitwise “and” of X and Y n X Y bitwise “or” of X and Y n X Y bitwise “xor” of X and Y n X bitwise complement of X n X + Y integer addition modulo 232 s n ROTL (X) circular left shift of X by s position (0 s 31) 39

Iterated Hash Function n n Algorithm 4. 8 SHA-1 -PAD(x) 64 - 1 n comment: |x| 2 n d (447 -|x|) mod 512 n l the binary representation of |x|, where |l| = 64 d n y x || 1 || 0 || l (|y| is multiple of 512) ft(B, C, D) = n (B C) (( B) D) if 0 t 19 n B C D if 20 t 39 n (B C) (B D) (C D) if 40 t 59 n B C D if 60 t 79 40

Iterated Hash Function n n Kt = n 5 A 827999 if 0 t 19 n 6 ED 9 EBA 1 if 20 t 39 n 8 F 1 BBCDC if 40 t 59 n CA 62 C 1 D 6 if 60 t 79 Cryptosystem 4. 1: SHA-1(x) n extern SHA-1 -PAD n global K 0, …, K 79 n y SHA-1 -PAD(x) denote y = M 1 || M 2 ||. . || Mn, where each Mi is a 512 block n H 0 67452301, H 1 EFCDAB 89, H 2 98 BADCFE, H 3 10325476, H 4 C 3 D 2 E 1 F 0 41

Iterated Hash Function n n for i 1 to n n denote Mi = W 0 || W 1 ||. . || W 15, where each Wi is a word n for t 16 to 79 do Wt ROTL 1(Wt-3 Wt-8 Wt-14 Wt-16) n A H 0, , B H 1, C H 2, D H 3, E H 4 n for t 0 to 79 temp ROTL 5(A) + ft(B, C, D) + E +Wt + Kt E D, D C, C ROTL 30(B), B A, A temp n H 0 + A, H 1 + B, H 2 + C, H 3 + D, H 4 + E 42 Return (H 0 || H 1 || H 2 || H 3 || H 4)

Iterated Hash Function n n n MD 4 proposed by Rivest in 1990 MD 5 modified in 1992 SHA proposed as a standard by NIST in 1993, and was adopted as FIPS 180 SHA-1 minor variation, FIPS 180 -1 SHA-256 SHA-384 SHA-512 43

4. 4 Message Authentication Codes n n n One common way of constructing a MAC is to incorporate a secret key into an unkeyed hash function. Suppose we construct a keyed hash function h. K from an unkeyed iterated hash function, h, by defining IV=K and keep its value secret. Attack: the adversary is a (1, 1)-forger n Suppose y = x || pad(x) in the preprocessing step, |y| = rt n x’=x || pad(x) || w, where w is any bitstring of length t n y’ = x’ || pad(x’) = x || pad(x) || w || pad(x’), |y’| = r’t for r’ > r 44

Message Authentication Codes In the processing step, zr = h. K(x) n Adversary can compute zr+1 compress(h. K(x)||yr+1) n zr+2 compress(zr+1 ||yr+2) n … n zr’ compress((zr’-11 || yr’) n h. K(x’) = zr’. Def: an (ε, q)-forger is an adversary who n queries message x 1, …, xq, n gets a valid (x, y), x ! {x 1, …, xq} n with the probability that the adversary outputs a 45 n n

Message Authentication Codes n 4. 4. 1 Nested MACs and HMAC n n A nested MAC builds a MAC algorithm from the composition of two hash families n (X, Y, K, G), (Y, Z, L, H) n composition: (X, Z, M, G H) n M= K L n G H = { g h: g G, h H } n (g h)(K, L)(x) = h. L( g. K(x) ) for all x X The nested MAC is secure if n (Y, Z, L, H) is secure as a MAC, given a fixed key n (X, Y, K, G) is collision-resistant, given a fixed key 46

Message Authentication Codes 3 adversaries: n n a forger for the nested MAC (big MAC attack) n (K, L) is secret n The adversary chooses x and query a big (nested) MAC oracle for values of h. L(g. K(x)) n output (x’, z) such that z = h. L(g. K(x’)) (x’ was not query) a forger for the little MAC (little MAC attack) (Y, Z, L, H) n L is secret n The adversary chooses y and query a little MAC oracle for values of h. L(y) n output (y’, z) such that z = h. L(y’) (y’ was not query) 47

Message Authentication Codes n a collision-finder for the hash function, when the key is secret (unknown-key collision attack) (X, Y, K, G) n n n K is secret The adversary chooses x and query a hash oracle for values of g. K(x) output x’, x’’ such that x’ x’’ and g. K(x’) = g. K(x’’) 48

Message Authentication Codes n n THEOREM 4. 9 Suppose (X, Z, M, G H) is a nested MAC. Suppose there does not exist an (ε 1, q+1)-collision attack for a randomly chosen function g. K G, when the key K is secret. Further, suppose that there does not exist an (ε 2, q)-forger for a randomly chosen function h. L H, where L is secret. Finally, suppose there exists an (ε, q)-forger for the nested MAC, for a randomly chosen function (g h)(K, L) G H. Then ε ε 1+ε 2 Proof Adversary queries x 1, . . , xq to a big MAC oracle and get (x 1, z 1). . (xq, zq) and outputs valid (x, z) 49

Message Authentication Codes n n n n x, x 1, . . , xq make q+1 queries to a hash oracle. y = g. K(x), y 1 = g. K(x 1), . . . , yq = g. K(xq) if y {y 1, . . , yq}, say y = yi, then x, xi is solution to Collision if y ! {y 1, . . , yq}, output (y, z) which is a valid pair for the little MAC. make q little MAC queries and get (y 1, z 1), . . . , (yq, zq) probability that (x, z) is valid and y ! {y 1, . . , yq} is at least ε-ε 1. Success probability of any little MAC attack is most ε 2 so ε 2 ε-ε 1 ε ε 1+ε 2 50

Message Authentication Codes n n HMAC is a nested MAC algorithm that is proposed FIPS standard. HMACK(x) = SHA-1( (K opad) || SHA-1( (K ipad) || x ) ) n x is a message n K is a 512 -bit key n ipad = 3636…. . 36 (512 bit) n opad = 5 C 5 C…. 5 C (512 bit) 51

Message Authentication Codes n 4. 4. 2 CBC-MAC n Cryptosystem 4. 2: CBC-MAC (x, K) n denote x = x 1 ||…|| xn , xi is a bitstring of length t n IV 00. . 0 (t zeroes) n y 0 IV n for i 1 to n do yi e. K(yi-1 xi) n return (yn) 52

Message Authentication Codes n (1/2, O(2 t/2))-forger attack t/2 n n 3, q 1. 17 2 n x 3, …, xn are fixed bitstrings of length t. n choose any q distinct bitstrings of length t, x 11, …, x 1 q, and randomly choose x 21, …, x 2 q i n define xl = xl, for 1 i q and 3 l n i i i n define x = x 1 ||…|| xn for 1 i q i j n x x if i j , because x 1. 1 2 q n The adversary requests the MACs of x , …, x 53

Message Authentication Codes n n n n In the computation of MAC of each xi, values y 0 i … yni are computed, and yni is the resulting MAC. Now suppose that and xi have xi identical MACs. h. K(xi) = h. K(xj) if and only if y 2 i = y 2 j, which happens if and only if y 1 i x 2 i = y 1 j x 2 j. Let x be any bitstring of length t v = x 1 i || (x 2 i x ) ||…||xni w = x 1 j || (x 2 j x ) ||…||xnj The adversary requests the MAC of v It is not difficult to see that v and w have identical MACs, so the adversary is successfully able to construct the MAC of w, i. e. h. K(w) = h. K(v)!!! 54

4. 5 Unconditionally Secure MACs (Skip this section!!) n n Unconditionally secure MACs n a key is used to produce only one authentication tag n an adversary make at most one query. Deception probability Pdq n maximum value of ε such that (ε, q)-forger for q = 0, 1 payoff (x, y) = Pr[y = h. K 0(x)] Impersonation attack ((ε, 0)-forger) n Pd 0 = max{ payoff(x, y): x X, y Y } (4. 1) 55

Unconditionally Secure MACs n Substitution attack ((ε, 1)-forger) n query x and y is reply, x X, y Y n probability that (x’, y’) is a valid is payoff(x’, y’; x, y), x’ X and x x’ n payoff(x’, y’; x, y) = Pr[y’ = h. K 0(x’)) | y = h. K 0(x)] = n n V = {(x, y): | {K K : h. K(x) = y} | 1} Pd 1 = max{ payoff(x’, y’; x, y): x, x’ X, y, y’ Y , (x, y) V, x x’} (4. 2) 56

Unconditionally Secure MACs n Example 4. 1 X = Y = Z 3 and K = Z 3 for each K = (a, b) K and each x X, h(a, b)(x) = ax + b mod 3 H = {h(a, b): (a, b) Z 3} n Pd 0 = 1/3 n query x = 0 and answer y = 0 possible key K 0 {(0, 0), (1, 0), (2, 0)} If (1, 1) is valid iff K 0 = (1, 0) The probability that K 0 is key is 1/3 Pd 1 = 1/3 Keyx 0 1 2 (0, 0) 0 0 0 (0, 1) 1 1 1 (0, 2) 2 2 2 (1, 0) 0 1 2 (1, 1) 1 2 0 (1, 2) 2 0 1 (2, 0) 0 2 1 (2, 1) 1 0 2 (2, 2) 2 1 0 Authentication matrix 57

Unconditionally Secure MACs n 4. 5. 1 Strongly Universal Hash Families n n Definition 4. 2: Suppose that (X, Y, K, H) is an (N, M) hash family. This hash family is strongly universal provided that the following condition is satisfied for every x, x’ X such that x x’, and for every y, y’ Y : |{K K : h. K(x) = y, h. K(x’) = y’}| = |K|/M 2 Example 4. 1 is a strongly universal (3, 3)-hash family. 58

Unconditionally Secure MACs n n LEMMA 4. 10 Suppose that (X, Y, K, H) is a strongly universal (N, M)-hash family. Then |{K K : h. K(x) = y}| = |K|/M for every x X and for every y Y. Proof x, x’ X and y Y, where x x’ |{K K : h. K(x) = y}| = 59

Unconditionally Secure MACs n n THEOREM 4. 11 Suppose that (X, Y, K, H) is a strongly universal (N, M)-hash family. Then (X, Y, K, H) is an authentication code with Pd 0 = Pd 1 = 1/M Proof From Lemma 4. 10 payoff(x, y) = 1/M for every x X and y Y, and Pd 0 = 1/M x, x’ X such that x x’ and y, y’ Y, where (x, y) V payoff(x’, y’; x, y)= Therefore Pd 1 = 1/M 60

Unconditionally Secure MACs n n THEOREM 4. 12 Let p be prime. For a, b Zp, define fa, b: Zp by the rule f(a, b)(x) = ax + b mod p Then (Zp, Zp Zp, {fa, b: Zp Zp}) is a strongly universal (p, p)-hash family. Proof x, x’, y, y’ Zp, where x x’. ax + b y (mod p), and a’x + b y’ (mod p) a = (y-y’)(x’-x)-1 mod p , and b = y - x(y’-y)(x’-x)-1 mod p (note that (x’ - x)-1 mod p exists because x ! x’ (mod p) and p is prime) 61

Unconditionally Secure MACs n THEOREM 4. 13 Let l be a positive integer and let p be prime. Define X = {0, 1}l {(0, …, 0)} For every (Zp)l, define f ( ): X Zp by the rule f ( ) = mod p where X and is the usual inner product of vectors. Then (X, Zp, (Zp)l, {f : (Zp)l}) is a strongly universal (2 l - 1, p)-hash family. 62

Unconditionally Secure MACs n Proof Let , X, , and let y, y’ Zp. Show that the number of vectors (Zp)l such that y (mod p) and y’ (mod p) is a constant. The desired vector are the solution of two linear equations in l unknowns over Zp. The two equations are linearly independent, and so the number of solution to the linear system is pl-2, which is a constant. 63

Unconditionally Secure MACs n 4. 5. 2 Optimality of Deception Probabilities n THEOREM 4. 14 Suppose (X, Y, K, H) is an (N, M)hash family. Then Pd 0 1/M. Further, Pd 0 = 1/M if and only if |{K K : h. K(x) = y}| = |K|/M (4. 3) for every x X, y Y. 64

Unconditionally Secure MACs n THEOREM 4. 15 Suppose (X, Y, K, H) is an (N, M)-hash family. Then Pd 1 1/M. 65

Unconditionally Secure MACs n n THEOREM 4. 16 Suppose (X, Y, K, H) is an (N, M)-hash family. Then Pd 1 1/M if and only if the hash family is strongly universal. proof has already proved in Theorem 4. 11. First show V = X Y Let (x, y’) X Y ; We will show (x’, y’) V Let x X, x x’. Choose y Y such that (x, y) V From Theorem 4. 15 (4. 4) for every x, x’ X, y, y’ Y such that (x, y) V. 66

Unconditionally Secure MACs |{K K : h. K(x’) = y’, h. K(x) = y}|>0 => |{K K : h. K(x’) = y’| > 0 This prove that (x’, y’) V, and hence V = X Y. From (4. 4) we know that (x, y) V and (x’, y’) V, so we can interchange the roles of (x, y) and (x’, y’). |{K K : h. K(x) = y}| = |{K K : h. K(x’) = y’}| for all x, x’, y, y’. |{K K : h. K(x) = y}| is a constant. |{K K : h. K(x’) = y’, h. K(x) = y}| is a constant 67

Unconditionally Secure MACs n n COROLLARY 4. 17 Suppose (X, Y, K, H) is an (N, M)-hash family such that Pd 1 = 1/M. Then Pd 0 = 1/M. Proof Under the stated hypotheses, Theorem 4. 16 says that (X, Y, K, H) is strongly universal. Then Pd 0 = 1/M from Theorem 4. 11. 68