Lecture 3 Cryptographic Hash Functions Message M H

Lecture 3 Cryptographic Hash Functions Message: M H: Hash Function Lecturer: Meysam Alishahi Design By: Z. Faraji and H. Hajiabolhassan 23 November 2020 Message Digest D D = H(M)

Hash Functions – a Hot Topic ü Hash functions take a variable-length message and reduce it to a shorter fixed message digest ü Many applications: “Swiss army knives” of cryptography: – Digital signatures (with public key algorithms) – Random number generation – Key update and derivation – One way function – Message authentication codes (with a secret key) – Integrity protection – code recognition (lists of the hashes of known good programs or malware) – User authentication (with a secret key) Commitment schemes 23– November 2020

Plan 1. Hash Functions and Data Integrity 2. Security of Hash Functions 3. Interated Hash Functions 4. Message Autentication Codes 5. Unconditionally Secure MACs 23 November 2020

Hashes, Message Digests Encrypting whole message is very expensive. 23 November 2020

Hashes, Message Digests A signed message digest (or hash) of the message is much more efficient. 23 November 2020

Why Is It Efficient? v Usually much shorter than the message. v Much faster to encrypt and decrypt. v Acts as a proxy for a lengthy message. v Make public-key cryptography more popular. v Like digital fingerprint or checksum of message. 23 November 2020

Classification Hash Function Unkeyed Other application Keyed Other application MDC OWHF CRHF preimage res. 2 nd-preimage 23 November 2020 collision res. MAC

Hash Functions: Main Idea . hash function H message x . . x’’ x’ bit strings of any length “message digest” . . y y’ n-bit strings • H is a lossy compression function – Collisions: h(x)=h(x’) for some inputs x, x’ – Result of hashing should “look random” (make this precise later) • Intuition: half of digest bits are “ 1”; any bit in digest is “ 1” half the time • Cryptographic hash function needs a few properties… 23 November 2020

Cryptographic Hash Function • Crypto hash function h(x) must provide – Compression output length is small – Efficiency h(x) easy to compute for any x – Preimage Resistant given a value y it is infeasible to find an x such that h(x) = y – Second Preimage Resistant given x and h(x), infeasible to find y x such that h(y) = h(x) – Collision Resistant infeasible to find any x and y, with x y such that h(x) = h(y) • Many collisions exist, but cannot find any 23 November 2020

Motivation: Integrity VIRUS bad. File good. File The Times hash(good. File) User Software manufacturer wants to ensure that the executable file is received by users without modification. It sends out the file to users and publishes its hash in NY Times. The goal is integrity, not secrecy Idea: given good. File and hash(good. File), very hard to find bad. File such that hash(good. File)=hash(bad. File) 23 November 2020

Motivation: Authentication KEY msg, hash(KEY, msg) Alice Bob Alice wants to make sure that nobody modifies message in transit Ensures both integrity and authentication (why? ) Idea: given msg, very hard to compute hash(KEY, msg) without KEY; very easy with KEY 23 November 2020

Password Protection Password= jeitlse 6 q What should we put in there? q What if backup tape stolen? q What property do we need? 23 November 2020 Password File U 1=… U 2=…

Definition A Hash family is a four-tuple (X , Y , K, H). Where the following conditions are satisfied: 1. X is a set of possible messages. 2. Y is a finite set of possible messages digests or autenication tags. 3. K, the key space, is a finite set of possible keys 4. For each kєK , there is a Hash function hk ЄH. Each hk : X Y 23 November 2020

Hash Functions • h is compress functions – X could be a finite or infinite set. – Y is a finite set. – |X | |Y | or stronger, |X | 2|Y |. • A pair (x , y) X Y is said to be valid under the key K – h. K(x) = y. • Let FX, Y denote the set of all function from X to Y. – |X| = N and |Y| = M. – |FX, Y| = MN. – F FX, Y is termed an (N, M)-hash family. • An unkeyed hash function is a function – h: X Y. 23 November 2020

Non-Crypto Hash (1) • Data X = (X 0, X 1, X 2, …, Xn-1), each Xi is a byte • Suppose hash(X) = X 0+X 1+X 2+…+Xn-1 • Is this secure? • Example: X = (1010, 00001111) • Hash is 10100101 • But so is hash of Y = (00001111, 1010) • Easy to find collisions, so not secure…

Non-Crypto Hash • Data X = (X 0, X 1, X 2, …, Xn-1) • Suppose hash is – h(X) = n. X 0+(n-1)X 1+(n-2)X 2+…+1 Xn-1 • Is this hash secure? At least h(1010, 00001111)=h(00001111, 1010) • Not secure, but it is used in the (non-crypto) application rsync. • Imagine you have two files, A and B, and you wish to update B to be the same as A. The obvious method is to copy A onto B. Now imagine that the two files are on machines connected by a slow communications link. If A is large, copying A onto B will be slow. 23 November 2020

A Short History of Practical Hash Functions Constructions and Their Failures • MDx family – Proposed by Ronald Rivest for RSA Labs – MD 2: 1989, Broken – MD 4, 1990, Broken – MD 5, 1992, Broken 128 -bit output • Inspired by MDx family – RIPEMD: 1995, Broken – RIPEMD-160: 1996 – Haval: 1992, Broken SHA family, (SHA: Secure Hash Algorithm) – also inspired by MDx family − Developed by NSA (National Security Agency) SHA-0, 1993, FIPS-180, US Gov. , 160 -bit output, Broken SHA-1, 1995, FIPS-180 -1, US Gov. , Theoretically broken in 2005 SHA-2, 2002, FIPS-180 -2, US Gov. , SHA-224/256/384/512 23 November 2020

Plan 1. Hash Functions and Data Integrity 2. Security of Hash Functions 3. Interated Hash Functions 4. Message Autentication Codes 5. Unconditionally Secure MACs 23 November 2020

We now define three poblems; if a hash function is to be considered secure, it should be the case that these three problems are difficult to solve. 23 November 2020

Security of Hash Functions Instance: A hash function h: X Y and an element yєY. Preimage: Find : xє X such that h(x)=y. Second Preimage Find : x΄є X such that x΄≠x and h(x΄)=h(x). Collision Find : x, x΄є X such that x΄≠x and h(x΄)=h(x). 23 November 2020

Random Oracle Model [Bellare, Rogaway, Random Oracles are Practical: A Paradigm for Designing Efficient Protocols, 1993] Idea: model the hash function as a random oracle. x H(x) H : {0, 1}* → {0, 1}L 23 November 2020 a completely random function

Criticism of the Random Oracle Model [Canetti, Goldreich, Halevi: The random oracle methodology, revisited. 1998] There exists a signature scheme that is • secure in Random oracle model but • is not secure if the random oracle is replaced with any real hash function. This example is very artificial. No “realistic” example of this type is know. 23 November 2020

Terminology • Plain model: In cryptography the plain model is the model of computation in which the adversary is only limited by the amount of time and computational power available. Other names used are bare model and standard model. Random Oracle Model is also called: the “Random Oracle Heuristic”. Common View: ROM proof is better than nothing. 23 November 2020

Other Uses of “Hash Functions” Hash functions are used by practitioners to convert “non-uniform randomness” into a uniform one. Example: shorter “uniformly random” H(m) a hash function H : {0, 1}* → {0, 1}L user generated randomness X (key strokes, mouse movements, etc. ) 23 November 2020 How to formalize it?

Pseudorandom Fnctions x x’ F( x) F ’) x ( F( x ’’) x’’ A random function F: {0, 1}m ---> {0, 1}m 23 November 2020 Crucial difference: Also the adversary can query the oracle

Theorem Suppose that is chosen randomly and let. Moreover, the values h(x) have been determined for xєX 0. p(h(x)=y)=1/|Y| 23 November 2020 (for all xєXX 0 , yєY)

Algorithm – Randomized algorithms make random choices during their execution. – A Las Vegas algorithm is a randomized algorithm which may fail to give an answer. If the algorithm does return an answer, then the answer must be correct. – A randomized algorithm has average-case success probability ε if the probability that the algorithm returns a correct answer, averaged over all problem instances of a specified size , is at least ε (0≤ε ≤ 1). – We use the terminology (ε, Q)-algorithm to denote a Las Vegas algorithm with average-case success probability ε. The number of oracle queries made by algorithms is at most Q. 23 November 2020

Algoithm 1: Find-Preimage(h, y, Q) Choose any for each xє X 0 do if h(x)=y then return (x) return (failure) Theorem. Let |Y|=M. For any with |X 0|=Q, the average-case success probability of Algorithm 1 is 23 November 2020

Proof Let yєY is fixed , X 0={x 1 , x 2 , …, x. Q }. E i : =the event h(x i )=y, 1≤ i≤Q We know E i ‘s are indepent events and p(E i )=1/M 1≤ i≤Q (by the last theorem) Consequently, The success probability of Algorithm 1, for any fixed y, is constant. Therefore, the success probability averaged over all y Y is identical, too. 23 November 2020

Algoithm 2: Find-Secound-Preimage(h, x, Q) Choose for each xє X 0 do if h(x)=y then return (x) return (failure) Theorem. Let |Y|=M. For any with |X 0|=Q-1, the average-case success probability of Algorithm 2 is 23 November 2020

Length of Hash Value? Birthday Paradox: What should be the size k of a group of people, such that with probability 1/2 at least two persons from the group will have birthday on the same day? 23 November 2020

Length of Hash Value? 23 November 2020

Algoithm 3: Find-Collision(h, Q) Choose for each xє X 0 do yx h(x) if yx=yx΄ for some x=x΄ then return (x, x΄) else return (failure) Theorem. Let |Y|=M. For any with |X 0|=Q, the average-case success probability of Algorithm 3 is 23 November 2020

Proof Let X 0={x 1 , x 2 , …, x. Q } , E i : =the event “ Clearly p(E 1 )=1, ” 2≤ i≤Q So 23 November 2020

Proof The probability that there is not any collision: Also, Hence, By ignoring the term Q 23 November 2020

Birthday Attacks Any function H: {0, 1}* ->{0, 1}n must have infinitely many collisions. It requires O(2 n/2) evaluations of H to find two messages m and m’ that have a collision, H(m)=H(m’). This means n must be reasonably large, otherwise it cannot be collision resistant. • This process is analogous to throwing k balls randomly into n bins and checking to see if some bin contains at least two balls. • For having more than half chance of finding at least two balls in one bin, k 1. 17 n 1/2 – E. g. n = 365 k 23 23 November 2020

Comparision of Securiy Criteria In random oracle model, we have seen that solving collision is easier than solving preimage or secound preimage. 23 November 2020

Question A related question is whethere exist reductions among the three problems which could be applied to arbitrary hash function? 23 November 2020

Algorithm 4: Collision-To-Secound-Preimage External Oracle-2 ND-Preimage Choose xєX uniformly at random If Oracle-2 ND-Preimage(h, x)=x΄ then return (x, x΄) Else return (failure) 23 November 2020

Notification If there exists an (є, Q)-algorithm for second preimage, then Collision-To-Secound Preimage is an (є, Q+1)-algorithm. 23 November 2020

Algorithm 5: Collision-To-Preimage(h) External Oracle-Preimage Choose xєX uniformly at random y h(x) If Oracle-Preimage(h, y)=x΄ and then return (x, x΄) Else return (failure) 23 November 2020

Theorem =hash function |X| , |Y| are finite and |X|≥ 2|Y| Oracle-Preimage is a (1, Q)-algorithm for Preimage (for the fixed hash function h). Collision-To-Preimage is a (1/2, Q+1)-algorithm for collision (for the fixed hash function h). 23 November 2020

Proof Clearly Collision-To-Preimage is a probabilistic Algorithm (Las Vegas type). So we must compute average-case probability of success. We define [x]={x 1єX: h(x)=h(x 1)} (for any xєX) Hence Э!yєY ; [x]= 23 November 2020

Proof On the other hand; we supposed Oracle-Preimage is a (1, Q)-algorithm. So (for any y єY) Therefore |[x]|=|Y| We define |Y|: = classes by C. We now suppose x is random element X chosen by the algorithm Collision-To-Preimage. 23 November 2020

Proof For this x, there are |[x]| possible x 1’s that could be returned as the output of Oracle-Preimage. For xєX; the probability of success = (|[x]|-1)/ |[x]| 23 November 2020

Proof So |X|≥ 2|Y| 23 November 2020

Plan 1. Hash Functions and Data Integrity 2. Security of Hash Functions 3. Interated Hash Functions 4. Message Autentication Codes 5. Unconditionally Secure MACs 23 November 2020

Detailed View original input x preprocessing append padding bits append length block formatted input x 1, x 2. . . xt compression xi function f Hi Hi-1 Ht H 0=IV g 23 November 2020 output h(x)=g(Ht) iterated processing

Iterated Hash Function Suppose that compression function ; t≥ 1. is a Our goal We construct an iterated hash function , based on the compression function compress. 23 November 2020

Iterated Hash Function • Iterated hash function h: • Suppose that compress: {0, 1}m+t {0, 1}m is a compression function ( where t 1). – Preprocessing • given x (|x| m + t + 1) • construct y(x) = x || pad(x) such that |y(x)| 0 (mod t) y (x)= y 1 || y 2 ||…|| yr, where |yi| = t for 1 i r • pad(x) is constructed from x using a padding function. • the mapping x -> y(x) must be an injection (1 to 1) 23 November 2020

Iterated Hash Function • For , we construct a string y(x) such that y(x)=y 1||…||yr, |yi|=t, 1≤i≤r • Output transportation = let be a public function. Define h(x)=g(zr) 23 November 2020

The Merkle-Damgard Construction Here we present a particular method of constructing a hash function from a compression function. 23 November 2020

Algorithm 6: Merkle-Damgard External compress Comment : s. t t≥ 2 x= x 1 || x 2 ||…|| xk, where |xi| =t-1 for 1 i k-1 23 November 2020

Algorithm 6: Merkle-Damgard do z i+1 g i||1||y i+1 compress(z i+1) h(x) g k+1 return (h(x)) 23 November 2020

Theorem Suppose is a collision resistant compression function, where t≥ 2. The output of algorithm 6 is a collision resistant hash function. 23 November 2020

Proof Suppose that we can find s. t Define y(x)=y 1||…||yk+1 , y(x΄)= y΄1||…||y΄l+1 x is padded with d 0’s, x’ is padded with d’ 0’s g-values : g 1, . . , gk+1 or g’ 1, . . , g’l+1 Case 1: |x|≠ |x΄| (mod t-1) d≠d΄, yk+1 ≠y΄l+1 We have compress(g k||1||yk+1)=g k+1=h(x)=h(x΄) =g΄l+1=compress(g΄l||1||y΄l+1) Which is a collision for compress, Because yk+1 ≠y΄l+1 23 November 2020

Proof Case 2: |x|=|x΄| (mod t-1) , |x|= |x΄|, k=l , yk+1=y΄k+1 y(x)=y 1||…||yk+1 , y(x΄)= y΄1||…||y΄k+1 We have compress(g k||1||yk+1)=g k+1=h(x)=h(x΄)=g΄k+1 =compress(g΄k||1||y΄k+1) If gk ≠g΄k , then we find a collision for compress. If gk = g΄k We have compress(g k-1||1||yk)= gk = g΄k =compress(g΄k-1||1||y΄k) 23 November 2020

Proof compress(gk-1 ||yk) = gk = g’k = compress (g’k-1 || y’k) Either we find a collision for compress, or gk-1 = g’k-1 and yk = y’k. Assuming we do not find a collision, we continue work backwards, until finally we obtain compress(0 m+1 || y 1) = g 1 = g’ 1 = compress (0 m+1||y’ 1) If y 1 y’ 1, then we find a collision for compress, so we assume y 1 = y’ 1. But then yi = y’i for 1 i k+1, so y(x) = y(x’). 23 November 2020

Case 3: |x|= |x΄| Proof (mod t-1) , |x|≠ |x΄| We assume that|x|<|x΄|. So k<l. In a similar fashion as Case 2 , we have But (m+1)st bit of And (m+1)st bit of Hence, we find a collision for compress. 23 November 2020

Algorithm 7: Merkle-Damgard 2 External compress Comment: f(0)=0, f(1)=01, x= x 1||…||xn Denote y= y 1||…||yk , where yi є{0, 1}, 1≤i ≤ k 23 November 2020

Theorem Suppose resistant compression function. is a collision The output of Algorithm 7 is a collision resistant hash function. 23 November 2020

Proof Suppose that we can find x=x΄ s. t h(x)=h(x΄). Denote y(x)= y 1 y 2…yk , y(x΄)= y΄1 y΄2…y΄k Case 1: k=l As in the last theorem, either we find a collision for compress, or we obtain y=y΄. So x=x΄. Case 2: k≠l, l>k. Assuming we find no collision for compress, we have the following sequence of equalities: yk=yl΄, yk-1=yl-1΄. . . y 1=yl-k+1΄ But this contradicts the postfix-free property stated above. 23 November 2020

The End 11/23/2020