One Way Functions Motivation Complexity Theory Review, Motivation One Way Functions: collision, pre-images SHA-1 One Way Functions CSCI284 Spring 2004 GWU

Advanced Cryptography: CSCI 297? Theory of secrecy: hard problems and crypto Elliptic curves Electronic Cash and Electronic Voting PRNGs Not much Cryptanalysis, Shannon secrecy 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

The problems crypto addresses Confidentiality/secrecy/privacy How to keep a message secret so it can be read only by a chosen person Use encryption Integrity How to determine a string of symbols has not been changed since it was created ? 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

CS284/Spring04/GWU/Vora/One-Way Functions Integrity Alice sends message x to Bob. She fears Oscar will manipulate it along the way, and Bob will get an incorrect message. She could encrypt it using a key Oscar did not have, but even so, when Bob decrypts the manipulated ciphertext, he gets an incorrect plaintext But maybe she could tell Bob something else about the message so he would know if something was terribly wrong: parity, last bit, a particular bit, etc. 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

In general, she could use a hash function h: X  Y y = h(x) |X| > |Y| i.e.  x, x’ s.t x  x’ and h(x) = h(x’) Used in storage tables E.g.: h(x) = last bit, parity, smallest prime factor 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Example 1: h(x) stored in secure location, not sent with x Bob somehow gets the value of h(x) and stores it safely so that the attacker cannot change it. Because h(x) is smaller (fewer bits) than x, telling Bob h(x) beforehand is different from telling him the message itself. When he receives h, he checks h(x). If it tallies with what he has, he assumes that x was not changed along the way. 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Example 2: h(x) sent with x Both Bob and Alice can create h(x) given x Alice sends (x, h(x)) Bob receives (x’,y’), he checks if y’ = h(x’). If so, he assumes x’ is what Alice sent 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

In either case, what can the attacker do? If he can compute h(x), he can: try to find x’ s.t. h(x) = h(x’). If he knows h, and can influence Alice, he can try to get her to send an x that she likes such that h(x) = h(x’) for an x’ he likes. If he doesn’t, he hopes for the best. 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Hence require an h “secure” in the following ways: Secure wrt second image requires that the following problem is “difficult”: Given an xX, find x’ X s.t x’  x but h(x’) = h(x) Secure wrt collision requires that the following problem is “difficult”: Find x, x’ X s.t x’  x but h(x’) = h(x) The above should be true even if h(x1), h(x2).. h(xn) are known 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

In general, h is a secure-hash, or a one-way function Easy to compute in one direction, hard in the other. Is the following h secure wrt second image and collision? h: Zn X Zn  Zn h(x, y) = ax + by mod n h(x, y) = ax2 + by2 mod n 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

CS284/Spring04/GWU/Vora/One-Way Functions Easy? How does one define easy to compute? Using computational complexity theory By requiring a large time for the computation on any computer given a particular computational model For example, the probabilistic polynomial-time model 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Algorithm Find Pre-Image(h, y, q) choose any X0  X, | X0 | = q for each x  X0 if h(x) = y return (x) endfor return(failure) What is the complexity of this algorithm? What is its probability of success? 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Algorithm Find Second Pre-Image(h, x, q) y  h(x) choose any X0  X\{x}, | X0 | = q-1 for each x0  X0 if h(x0) = y return (x0) endfor return(failure) What is the complexity of this algorithm? What is its probability of success? 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Algorithm Find Collision (h, q) choose any X0  X, | X0 | = q for each x  X0 yx  h(x) endfor for all pairs (x, x’) if yx = yx’ return (x, x’) return(failure) 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Probability of success For a lower bound, can assume that sizes of pre-images are about equal, so that one pre-image is not very large - if it were, it would be very easy to have a collision in that pre-image. M = |Y| probability of no collisions = q-1i=1(1 - i/M) probability of at least one collision: (using e-x/M  1 -x/M) 1 - q-1i=1(1 - i/M)  1 - e-q(q-1)/2M 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

CS284/Spring04/GWU/Vora/One-Way Functions Allowed n, q For a given acceptable collision probability p, what is q in terms of M and p? p = 1 - q-1i=1(1 - i/M)  1 - e-q(q-1)/2M q  (2M ln(1/1-p)) For p = 0.5, q  1.17M if M = 365, q  23 and the probability of 2 people having the same birthday in a group of 23 people is more than 0.5 – Birthday attack/paradox 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Complexities/Probability of success Find Pre-Image Success Probability: 1-(1-1/M)q  q/M Complexity: (q) Find Second Pre-Image Success Probability: 1-(1-1/M)q-1  q/M Find Collision Success Probability: 1 - q-1i=1(1 - i/M)  1 - e-q(q-1)/2M Complexity: (q2) 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Example: Traveling Salesman Given a set of points and the cost of going from each to another, find a least cost path that covers all points n points Try all combinations T(n) = n! 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

CS284/Spring04/GWU/Vora/One-Way Functions Definitions Polynomial time: When the worst-case running time of an algorithm is polynomial in the size of the input Exponential time: When the worst-case running time of an algorithm is exponential in the size of the input 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Polynomial vs. Exponential 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

Non-deterministic Polynomial: NP When you can check that a solution is correct in polynomial time Example: Travelling Salesman, all polynomial-time algorithms, discrete log, roots of a polynomial 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

CS284/Spring04/GWU/Vora/One-Way Functions SHA-1 Pad given string x so that it is of length a multiple of 512 bits. Call this string y = M1||M2||…||Mn Iteratively calculate the hash of y using a hash function (known as the compression function) for 512 bits (hash is of length 160 bits) What is complexity of a birthday attack? 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions

CS284/Spring04/GWU/Vora/One-Way Functions SHA-1 contd. current_hash = H0||H1||H2||H3||H4 for i=1, 2, ..n A||B||C||D||E|| = h(Mi, current_hash) H0+=A; H1+=B; … endfor 4/24/2019 CS284/Spring04/GWU/Vora/One-Way Functions