Lect 16 17 Hash Functions and MAC Contents

Lect. 16 - 17: Hash Functions and MAC

Contents 1. 2. Introduction - Hash Function vs. MAC Hash Functions v Security Requirements v Finding collisions – birthday paradox v Dedicated hash functions v SHA-1 v Hash functions based on block ciphers 2

1. Hash Functions vs. MAC 3

Hash Functions Message M v Hash Function ü Generate a fixed length “Fingerprint” for an arbitrary length message ü No Key involved ü Must be at least One-way to be useful v Applications H ü Keyed hash: MAC/ICV generation ü Unkeyed hash: digital signature, password file, key stream / pseudo-random number generator v Constructions ü Iterated hash functions (MD 4 -family hash functions): MD 5, SHA 1, SHA 2, RMD 160, HAS 160 ü Hash functions based on block ciphers: MDC(Manipulation Detection Code) Message Digest D D = H(M) 4

Message Authentication Codes (MACs) Ø MAC ü Generate a fixed length MAC for an arbitrary length message ü A keyed hash function ü Message origin authentication ü Message integrity ü Entity authentication ü Transaction authentication ü Keyed hash: HMAC, KMAC ü Block cipher: CBC-MAC ü Dedicated MAC: MAA, UMAC MAC SEND Ø Constructions Shared Secret Key MAC 5

Comparison of Hash Function & MAC Arbitrary length message Hash function MAC function Secret key Hash fixed length MAC fixed length § Easy to compute § Compression: arbitrary length input to fixed length output § Unkeyed function vs. Keyed function 6

Symmetric Authentication (MAC) Bob Alice Message KAB Shared Secret key between Alice and Bob Secret key algorithm MAC Message transmit KAB Shared Secret key between Alice and Bob yes MAC Secret key algorithm MAC no 7

Digital Signature Bob Alice Message Signature Message transmit Hash function Hash value Public key algorithm Alice’s Private key Signature Hash function Hash value 1 yes no Alice’s Public key Hash value 2 Public key algorithm 8

MAC and Digital Signature v MAC (Message Authentication Code) Ø Generated and verified by a secret key algorithm Ø Message origin authentication & Message integrity Ø Schemes ü Keyed hash: HMAC ü Block cipher: CBC-MAC, XCBC-MAC ü Dedicated MAC: UMAC v Digital Signature Ø Generated and verified by a public key algorithm and a hash function Ø Message origin authentication & Message integrity Ø Non-repudiation Ø Schemes üHash + Digital signature algorithm üRSA; DSA, KCDSA; ECDSA, EC-KCDSA 9

2. Hash Functions 10

Hash Functions – Requirements v Definition Ø Compression: arbitrary length input to fixed length output Ø Ease of computation v Security Properties Ø Preimage resistance (One-wayness) : § Given y, it is computationally infeasible to find any input x such that y = h(x) Ø 2 nd preimage resistance (Weak collision resistance) : § Given x, it is computationally infeasible to find another input x x such that h(x) = h(x ) Ø Collision resistance (Strong collision resistance) : § It is computationally infeasible to find any two distinct inputs x and x such that h(x) = h(x ) 11

Brute Force Attack on One-Way Hash Functions Given y, find m such that h(m) = y mi for i = 1, 2, . . . 2 n h Arbitrary message m Or m of the same meaning ? h(mi) = y ? n bits 12

Constructing Multiple Versions of the Same Message I state confirm Mr. Dr. thereby that I borrowed received Kris Krzysztof should be is required to Gaj on October 15, 15 October $10, 000 from ten thousand dollars 2001. This money amount of money returned to Mr. Gaj by November 30, 2001. given back Dr. 30 November 11 different positions of similar expressions 211 different messages of the same meaning 13

Finding Collision in Collision-Resistant Hash Functions Find any two distinct messages m, m such that h(m) = h(m ). mi for i = 1, 2, . . . 2 m h h h(mi) n bits mi How large m should be to get a match ? h(mi ) n bits 14

Birthday Paradox How many students there must be in a class for there be a greater than 50% chance that 1. One of the students shares the teacher’s birthday ? (complexity breaking one-wayness) 365/2 188 2. Any two of the students share the same birthday ? (complexity breaking collision resistance) 1 – 365 364 . . . (365 -k+1) / 365 k > 0. 5 k 23 In general, the probability of a match being found when k samples are randomly selected between 1 and n equals 15

One Million $ Hardware Brute Force Attack v One-Way Hash Functions (complexity = 2 n) Year 2001 n = 64 4 days n = 80 718 years n = 128 1017 years v Collision-Resistant Hash Functions (complexity = 2 n/2) Year 2001 n = 128 4 days n = 160 718 years n = 256 1017 years 16

General Construction of a Secure Hash Function Message m 100… 000 length Padding & length encoding M 1 M 2 b b IV=H 0 n f Mt M 3 b b n f H 1 Legend: § IV : Initial Value § Hi : i-th Chaining variable § Mi : i-th input block § f : Compression function f n H 2 n . . . n f Ht-1 § g : Output transformation (optional) § t : Number of input blocks § b : Block size in bits § n : Hash code size in bits n Ht g h(m) 17

General Construction of a Secure Hash Function Mi b Compression Function (fixed-size hash function) Entire hash n f n Hi Hi-1 H 0 = IV Hi = f (Hi-1, Mi) for 1 i t H(m) = g(Ht) Fact(by Merkle-Damgård) Any collision-resistant compression function f can be extended to a collision-resistant hash function h 18

Typical Hash Padding v Assume Block size = 512 bits (MD 5, SHA 1, RMD 160, HAS 160 …) Last 512 -bit block Message m 100… 000 length Let r = |m| mod 512 If 512 -r > 64 padding = 512 -(r+64) bits 64 bit integer (bit-length of message m) else padding = 512 -r+448 bits (two padding blocks) 19

Classification of Hash Functions Dedicated (Customized) MD 2 Based on block ciphers Broken MDC-1 MDC-2 MDC-4 Broken SHA 0 RIPEMD-128 Broken MD 4 Broken MD 5 Weakness discovered Based on Modular Arith. MASH-1 HAS-160 Reduced round Version broken SHA 1 RIPEMD-160 SHA 2 20

SHA (Secure Hash Algorithm) (1/2) v SHA was designed by NIST (national institute of standards and technology) & NSA (National Security Agency) v US standard for use with DSA signature scheme v The algorithm is SHA, the standard is SHS v Based on the design of MD 4 and MD 5 by R. Rivest MIT v. SHA-0: FIPS PUB 180, 1993 v. SHA-1: FIPS Pub 180 -1, 1995 übitwise rotation of message schedule of SHA-0 changed üwidely-used security applications and protocols such as TLS and SSL, PGP, SSH, S/MIME, and IPsec v. SHA-2: FIPS Pub 180 -2, 2001 üSHA-224, SHA-256, SHA-384, and SHA-512 üNot so popular as SHA-1 * Federal Information Processing Standard 21

SHA (Secure Hash Algorithm) (2/2) Algorithm and variant SHA-0 160 512 264 − 1 32 80 +, and, or, xor, rot Yes (252 attack (*)[ 160 512 264 − 1 32 80 +, and, or, xor, rot SHA 256/22 4 256/224 256 512 264 − 1 32 64 +, and, or, xor, shr, rot None SHA 512/38 4 512/384 512 1024 2128 − 1 64 80 +, and, or, xor, shr, rot None SHA-1 SHA-2 Internal Max me. Output Block Word Collisions state size ssage size Rounds Operation size (bits) found (bits) * Cameron Mc. Donald, Philip Hawkes and Josef Pieprzyk, SHA-1 collisions now 2^52, Eurocrypt 2009 Rump session, http: //eurocrypt 2009 rump. cr. yp. to/ 837 a 0 a 8086 fa 6 ca 714249409 ddfae 43 d. pdf. 22

SHA-1 Overview Yq CVq 512 160 A B round 0 A A round 79 D E f 1, ABCDE, Yq, K 0, w 0 B round 1 C C D E f 2, ABCDE, Yq, K 1, w 1 B C D E f 80, ABCDE, Yq, K 79, w 79 160 CVq+1 23

SHA-1 round function A B C D E Input buffer Boolean function ft Cyclic left shift CLS 5 CLS 30 A B C D E Wt From message Kt Constants Output buffer 24

SHA-1 Initial values A=67452301 B=EFCDAB 89 C=98 BADCFE D=10325476 E=C 3 D 2 E 1 F 0 Constants Kt t = 0 ~ 19 Kt = 5 A 8 2 7 9 9 9 t = 20 ~ 39 Kt = 6 E D 9 E B A 1 t = 40 ~ 59 Kt = 8 F 1 B B C D C t = 60 ~ 79 Kt = C A 6 2 C 1 D 6 Boolean function ft t = 0 ~ 19 t = 20 ~ 39 t = 40 ~ 59 t = 60 ~ 79 ft (B, C, D) = B · C + B · D ft (B, C, D) = B C D ft (B, C, D) = B · C + B · D + C · D ft (B, C, D) = B C D 25

SHA-1 32 message inputs 512 -bit w 2 Yq w 0 32 w 0 w 1 w 8 32 CLS 1 w 15 w 16 wt– 14 wt– 8 w 65 w 13 wt– 16 wt– 3 w 63 CLS 1 wt w 71 w 76 CLS 1 w 79 CLS: Cyclic Left Shift 26

Step Operations of MD 5 & SHA 1 D C B A A B C + fr D + fr + Mi + Kr + <<5 <<si E <<30 + Mi + Kr E Big endian + D 15 C. . . B A 01 Little endian A 01 B. . . C D 19 27

Step Operations of SHA 1 & HAS 160 A B C D fr <<5 <<30 A 01 B. . . C D E E + + + Mi Mi + + Kr Kr <<s +r E 19 D C A B fr <<si <<sr D C. . . B A 10 28

Comparison of Popular Hash Functions Hash Func. MD 5 SHA 1 RMD 160 HAS 160 Digest size(bits) 128 160 160 Block size(bits) 512 512 No of steps 64(4 x 16) 80(4 x 20) 160(5 x 2 x 16) 80(4 x 20) Boolean func. 4 4(3) 5 4(3) Constants 64 4 9 4 Endianness Little Big Little Speed ratio 1. 0 0. 57 0. 5 0. 94 29

Hash Functions Based on Block Ciphers: MDC 1 Matyas-Meyer-Oseas Scheme Hi-1 Mi block size g E Compression function f g: a function mapping an input Hi to a key suitable for E, might be the identity function block size Hi • Provably Secure under an appropriate blackbox model • But produces too short hash codes for use in most applications 30

Hash Functions Based on Block Ciphers: MDC 2 Mi Hi-1 Compression function f E g g E A B C D A D C B Hi Hi-1 Hi 31

Ex. of MD 5 Collisions Collision 1. bin Collision 2. bin Same MD 5 Hashed Value !! 32

Practical Collision Attacks (MD 5) • Colliding valid X. 509 certificates – Lenstra, Wang, Weger, forged X. 509 certificates， http: //eprint. iacr. org/2005/067. pdf Same owner with different public keys (2048 bits) – Stevens, Lenstra, Weger, Eurocrypt 2007 8192 -bit public key (8 -block collision) – Stevens etc. Crypto 2009 Pass the browser authentication, different owners, different public keys (See next page. ) 33

X. 509 v 3 Real and Fake Certificates 34

SHA-3 Project 35