Chapter 12 – Hash Algorithms INCS 741: CRYPTOGRAPHY Chapter 12 – Hash Algorithms Dr. Lo’ai Tawalbeh New York Institute of Technology (NYIT) Jordan’s Campus Dr. Lo’ai Tawalbeh Summer 2007

Using Symmetric Ciphers for MACs can use any block cipher chaining mode and use final block as a MAC Data Authentication Algorithm (DAA) is a widely used MAC based on DES-CBC using IV=0 and zero-pad of final block encrypt message using DES in CBC mode and send just the final block as the MAC or the leftmost M bits (16≤M≤64) of final block Can also use block cipher chaining modes to create a separate authenticator, by just sending the last block. However this suffers from being a bit too small for acceptable use today. Dr. Lo’ai Tawalbeh Summer 2007

Hash Functions condenses arbitrary message to fixed size usually assume that the hash function is public and not keyed different than MAC which is keyed hash used to detect changes to message can be used in various ways with message, mostly to create a digital signature a Hash Function produces a fingerprint of some file/message/data h = H(M) Dr. Lo’ai Tawalbeh Summer 2007

Hash Functions & Digital Signatures Stallings Fig 11-5c. Dr. Lo’ai Tawalbeh Summer 2007

Requirements for Hash Functions can be applied to any sized message M produces fixed-length output h is easy to compute h=H(M) for any message M given h is infeasible to find x s.t. H(x)=h one-way property is infeasible to find any x,y s.t. H(y)=H(x) strong collision resistance These are the specifications for good hash functions. Essentially it must be extremely difficult to find 2 messages with the same hash, and the hash should not be related to the message in any obvious way (ie it should be a complex non-linear function of the message). There are quite a few similarities in the evolution of hash functions & block ciphers, and in the evolution of the design requirements on both. Dr. Lo’ai Tawalbeh Summer 2007

Simple Hash Functions are several proposals for simple functions based on XOR of message blocks not secure since can manipulate any message and either not change hash or change hash also need a stronger cryptographic function (next chapter) Dr. Lo’ai Tawalbeh Summer 2007

Block Ciphers as Hash Functions can use block ciphers as hash functions using H0=0 and zero-pad of final block compute: Hi = EMi [Hi-1] and use final block as the hash value similar to CBC but without a key resulting hash is too small (64-bit)- Dr. Lo’ai Tawalbeh Summer 2007

Hash Example: Secure Hash Algorithm-SHA Maximum length of the input is < 2^64 bits and outputs 160-bit digest 1. pad message so its length is congruent to 448 mod 512 (first bit 1, then followed by zeros) 2. append a 64-bit integer value to the msg (cantinas the original msg length). 3. initialise 5-word (160-bit) buffer (A,B,C,D,E) to (67452301,efcdab89,98badcfe,10325476,c3d2e1f0) 4. process message in 16-word (512-bit) blocks: expand 16 words into 80 words by mixing & shifting use 4 rounds of 20 bit operations on message block & buffer add output to input to form new buffer value output hash value is the final buffer value Note that the SHA-1 Overview is very similar to that of MD5. Dr. Lo’ai Tawalbeh Summer 2007

Hash Example: Secure Hash Algorithm-SHA Note that the SHA-1 Overview is very similar to that of MD5. Dr. Lo’ai Tawalbeh Summer 2007

SHA-1 Compression Function each round has 20 steps which replaces the 5 buffer words thus: (A,B,C,D,E) <-(E+f(t,B,C,D)+(A<<5)+Wt+Kt),A,(B<<30),C,D) A,B,C,D, E refer to the 5 words of the buffer t is the step number f(t,B,C,D) is nonlinear function for round (t) Wt is derived from the message block Kt is a constant value Can see SHA shares much in common with MD4/5, but with 20 instead of 16 steps in each of the 4 rounds. Note the 4 constants are based on sqrt(2,3,5,10). Note also that instead of just splitting the input block into 32-bit words and using them directly, SHA-1 shuffles and mixes them using rotates & XOR’s to form a more complex input, and greatly increases the difficulty of finding collisions. Dr. Lo’ai Tawalbeh Summer 2007

SHA-1 Compression Function Stallings Fig 12-6. Dr. Lo’ai Tawalbeh Summer 2007

Wt generation Stallings Fig 12-6. Dr. Lo’ai Tawalbeh Summer 2007

Revised Secure Hash Standard NIST have issued a revision FIPS 180-2 adds 3 additional hash algorithms SHA-256, SHA-384, SHA-512 designed for compatibility with increased security provided by the AES cipher structure & detail is similar to SHA-1 hence analysis should be similar See Stallings Tables 12.3 and 12.4 for details. Dr. Lo’ai Tawalbeh Summer 2007

Keyed Hash Functions as MACs have desire to create a MAC using a hash function rather than a block cipher because hash functions are generally faster Widely available not limited by export controls unlike block ciphers hash includes a key along with the message Incorporation of a secret key to an existing hash function- e.g., HMAC Dr. Lo’ai Tawalbeh Summer 2007

HMAC specified as Internet standard, used in IP security, SSL. uses hash function on the message: HMACK = Hash[(K+ XOR opad) || Hash[(K+ XOR ipad)||M)]] where K+ is the key padded out to size and opad, ipad are specified padding constants overhead is just 3 more hash calculations than the message needs alone any of MD5, SHA-1, RIPEMD-160 can be used The idea of a keyed hash evolved into HMAC, designed to overcome some problems with the original proposals. Further have a design that has been shown to have the same security as the underlying hash alg. The hash function need only be used on 3 more blocks than when hashing just the original message (for the two keys + inner hash). Choose hash alg to use based on speed/security concerns. Dr. Lo’ai Tawalbeh Summer 2007

HMAC Overview Stallings Fig 12-10. Dr. Lo’ai Tawalbeh Summer 2007

HMAC Security know that the security of HMAC relates to that of the underlying hash algorithm attacking HMAC requires either: brute force attack on key used choose hash function used based on speed verses security constraints Dr. Lo’ai Tawalbeh Summer 2007