1. Chapter 12 – Hash Algorithms
INCS 741: CRYPTOGRAPHY
Chapter 12 – Hash Algorithms
Dr. Lo’ai Tawalbeh
New York Institute of Technology (NYIT) Jordan’s Campus
Dr. Lo’ai Tawalbeh Summer 2007

2. Using Symmetric Ciphers for MACs
can use any block cipher chaining mode and use final block as a MAC
Data Authentication Algorithm (DAA) is a widely used MAC based on DES-CBC
using IV=0 and zero-pad of final block
encrypt message using DES in CBC mode
and send just the final block as the MAC
or the leftmost M bits (16≤M≤64) of final block
Can also use block cipher chaining modes to create a separate authenticator, by just sending the last block. However this suffers from being a bit too small for acceptable use today.
Dr. Lo’ai Tawalbeh Summer 2007

3. Hash Functions condenses arbitrary message to fixed size
usually assume that the hash function is public and not keyed
different than MAC which is keyed
hash used to detect changes to message
can be used in various ways with message, mostly to create a digital signature
a Hash Function produces a fingerprint of some file/message/data
h = H(M)
Dr. Lo’ai Tawalbeh Summer 2007

4. Hash Functions & Digital Signatures
Stallings Fig 11-5c.
Dr. Lo’ai Tawalbeh Summer 2007

5. Requirements for Hash Functions
can be applied to any sized message M
produces fixed-length output h
is easy to compute h=H(M) for any message M
given h is infeasible to find x s.t. H(x)=h
one-way property
is infeasible to find any x,y s.t. H(y)=H(x)
strong collision resistance
These are the specifications for good hash functions. Essentially it must be extremely difficult to find 2 messages with the same hash, and the hash should not be related to the message in any obvious way (ie it should be a complex non-linear function of the message). There are quite a few similarities in the evolution of hash functions & block ciphers, and in the evolution of the design requirements on both.
Dr. Lo’ai Tawalbeh Summer 2007

6. Simple Hash Functions are several proposals for simple functions
based on XOR of message blocks
not secure since can manipulate any message and either not change hash or change hash also
need a stronger cryptographic function (next chapter)
Dr. Lo’ai Tawalbeh Summer 2007

7. Block Ciphers as Hash Functions
can use block ciphers as hash functions
using H0=0 and zero-pad of final block
compute: Hi = EMi [Hi-1]
and use final block as the hash value
similar to CBC but without a key
resulting hash is too small (64-bit)-
Dr. Lo’ai Tawalbeh Summer 2007

8. Hash Example: Secure Hash Algorithm-SHA
Maximum length of the input is < 2^64 bits and outputs 160-bit digest
1. pad message so its length is congruent to 448 mod 512
(first bit 1, then followed by zeros)
2. append a 64-bit integer value to the msg (cantinas the original msg length).
3. initialise 5-word (160-bit) buffer (A,B,C,D,E) to
( ,efcdab89,98badcfe, ,c3d2e1f0)
4. process message in 16-word (512-bit) blocks:
expand 16 words into 80 words by mixing & shifting
use 4 rounds of 20 bit operations on message block & buffer
add output to input to form new buffer value
output hash value is the final buffer value
Note that the SHA-1 Overview is very similar to that of MD5.
Dr. Lo’ai Tawalbeh Summer 2007

9. Hash Example: Secure Hash Algorithm-SHA
Note that the SHA-1 Overview is very similar to that of MD5.
Dr. Lo’ai Tawalbeh Summer 2007

10. SHA-1 Compression Function
each round has 20 steps which replaces the 5 buffer words thus:
(A,B,C,D,E) <-(E+f(t,B,C,D)+(A<<5)+Wt+Kt),A,(B<<30),C,D)
A,B,C,D, E refer to the 5 words of the buffer
t is the step number
f(t,B,C,D) is nonlinear function for round (t)
Wt is derived from the message block
Kt is a constant value
Can see SHA shares much in common with MD4/5, but with 20 instead of 16 steps in each of the 4 rounds. Note the 4 constants are based on sqrt(2,3,5,10). Note also that instead of just splitting the input block into 32-bit words and using them directly, SHA-1 shuffles and mixes them using rotates & XOR’s to form a more complex input, and greatly increases the difficulty of finding collisions.
Dr. Lo’ai Tawalbeh Summer 2007

11. SHA-1 Compression Function
Stallings Fig 12-6.
Dr. Lo’ai Tawalbeh Summer 2007

12. Wt generation
Stallings Fig 12-6.
Dr. Lo’ai Tawalbeh Summer 2007

13. Revised Secure Hash Standard
NIST have issued a revision FIPS 180-2
adds 3 additional hash algorithms
SHA-256, SHA-384, SHA-512
designed for compatibility with increased security provided by the AES cipher
structure & detail is similar to SHA-1
hence analysis should be similar
See Stallings Tables 12.3 and 12.4 for details.
Dr. Lo’ai Tawalbeh Summer 2007

14. Keyed Hash Functions as MACs
have desire to create a MAC using a hash function rather than a block cipher
because hash functions are generally faster
Widely available
not limited by export controls unlike block ciphers
hash includes a key along with the message
Incorporation of a secret key to an existing hash function- e.g., HMAC
Dr. Lo’ai Tawalbeh Summer 2007

15. HMAC specified as Internet standard, used in IP security, SSL.
uses hash function on the message:
HMACK = Hash[(K+ XOR opad) ||
Hash[(K+ XOR ipad)||M)]]
where K+ is the key padded out to size
and opad, ipad are specified padding constants
overhead is just 3 more hash calculations than the message needs alone
any of MD5, SHA-1, RIPEMD-160 can be used
The idea of a keyed hash evolved into HMAC, designed to overcome some problems with the original proposals. Further have a design that has been shown to have the same security as the underlying hash alg. The hash function need only be used on 3 more blocks than when hashing just the original message (for the two keys + inner hash). Choose hash alg to use based on speed/security concerns.
Dr. Lo’ai Tawalbeh Summer 2007

16. HMAC Overview
Stallings Fig
Dr. Lo’ai Tawalbeh Summer 2007

17. HMAC Security
know that the security of HMAC relates to that of the underlying hash algorithm
attacking HMAC requires either:
brute force attack on key used
choose hash function used based on speed verses security constraints
Dr. Lo’ai Tawalbeh Summer 2007