1. Higher Order Universal One-Way Hash Functions Deukjo Hong Graduate School of Information Security, Center for Information Security Technologies, Korea University

2. Contents Security Notions of Hash Functions Extension of UOWHF of order r Construction of UOWHF of order r Conclusion

3. Security Notions of Hash Functions F: D R is a function. For x,x D, (x,x ) is a collision under F. x x and F(x) = F(x ).

4. Security Notions of Hash Functions CRHF A Family of Function, H: K M C H is a (t, )-CRHF if any adversary A with the running time t cannot win the Game crhf (H,A) with the success probability at least. If (x,x ) is a collision under H K, A wins. Game crhf (H,A) K ur K(x,x ) A(K)

5. Security Notions of Hash Functions UOWHF A Family of Function, H: K M C H is a (t, )-UOWHF if any adversary A= (A 1,A 2 ) with the running time t cannot win the Game uowhf (H,A) with the success probability at least. (If (x,x ) is a collision under H K, A wins.) Game uowhf (H,A) (x,state) A 1 x A 2 (K,x,state) K ur K

6. Security Notions of Hash Functions A UOWHF has some advantages compared to a CRHF. Security bound is 2 n when the output length is n. A UOWHF is weaker than a CRHF. A UOWHF is easier to design than a CRHF. Ask less of a hash function and it is less likely to disappoint!

7. Security Notions of Hash Functions UOWHF(r): UOHWF of order r A Family of Function, H: K M C H is a (t, )-UOWHF(r) if any adversary A= (A 1,A 2 ) with the running time t cannot win the Game uowhf(r) (H,A) with the success probability at least. (If (x,x ) is a collision under H K, A wins.)

8. Security Notions of Hash Functions Game uowhf(r) (H,A) (x,state) A 1 x A 2 (K,x,state) K ur K A1A1 OHKOHK query x i answer H K (x i ) r times

9. Security Notions of Hash Functions Relationship among the notions Let H: K M C be a family of hash functions. H: UOWHF H: UOWHF(0). H: UOWHF(r+1) H: UOWHF(r). H: CRHF H: UOWHF(r)

10. Extension of UOWHF(r) H: UOWHF(r) MD t [H]: UOWHF for t r+1 c+m bitsc bits K H x0x0 x1x1 H x2x2 H x t-1 H xtxt y1y1 y2y2 y t-2 y t-1 ytyt H K KKK … MC

11. Extension of UOWHF(r) H: UOWHF(r), r = (d l -d)/(d-1) H … M: m = dc bits K C: c bits

12. Extension of UOWHF(r) Then, TR t [H]: UOWHF for t l HKHK HKHK HKHK HKHK HKHK HKHK HKHK HKHK HKHK HKHK …… … ……… ……… … ……… … … … … … … ……

13. Extension of UOWHF(r) The following sets of functions are considered under same key space, domain, and range. CF = {H | H is a CRHF} MD(r) = {H | H and MD r [H] are UOWHFs} UF(r) = {H | H is a UOWHF(r)}

14. Extension of UOWHF(r) CF UOWHF =UF(0) UF(3)UF(2)UF(1) … MD(4) MD(3)MD(2) …

15. Construction of UOWHF(r) Naor and Yungs construction of a UOWHF. Resource: F: a One-Way Permutation on {0,1} n. Chop: a function which chops the lsb of the input. G a,b (x) = Chop(ax+b) for a 0,b,x {0,1} n. H = {H a,b | H a,b (x) = G a,b (F(x))}. H is a UOWHF(1) if F is a one-way permutation.

16. Construction of UOWHF(r) Generalization: G a r,…,a 0 (x) = Chop(a r x r +…+a 1 x+a 0 ). H = {H a r,…,a 0 | H a r,…,a 0 (x) = G a r,…a 0 (F(x))}. H is a UOWHF(r) if F is a one-way permutation.

17. Conclusion The existing extensions for UOWHFs require random key values whose total length increase with message length. The notion of UOWHF with order is helpful for reducing total key length of existing extensions for UOWHFs. UOWHF of order r can be constructed to be provably secure from a one-way permutation.