1. CSCE 715: Network Systems Security
Chin-Tser Huang
University of South Carolina

2. Message Authentication
Message authentication is concerned with
protecting the integrity of a message
validating identity of originator
non-repudiation of origin (dispute resolution)
Three alternative functions to provide message authentication
message encryption
message authentication code (MAC)
hash function
9/21/2006

3. Providing Msg Authentication by Symmetric Encryption
Receiver knows sender must have created it because only sender and receiver know secret key
Can verify integrity of content if message has suitable structure, redundancy or a checksum to detect any modification
9/21/2006

4. Providing Msg Authentication by Asymmetric Encryption
Encryption provides no confidence of sender because anyone potentially knows public key
However if sender encrypts with receiver’s public key and then signs using its private key, we have both confidentiality and authentication
Again need to recognize corrupted messages
But at cost of two public-key uses on message
9/21/2006

5. Providing Msg Authentication by Asymmetric Encryption
9/21/2006

6. Message Authentication Code (MAC)
Generated by an algorithm that creates a small fixed-sized block
depending on both message and some key
like encryption though need not to be reversible
Appended to message as a signature
Receiver performs same computation on message and checks if it matches the MAC
Provide assurance that message is unaltered and comes from claimed sender
9/21/2006

7. Uses of MAC
9/21/2006

8. MAC Properties Cryptographic checksum Many-to-one function MAC = CK(M)
condenses a variable-length message M
using a secret key K
to a fixed-sized authenticator
Many-to-one function
potentially many messages have same MAC
make sure finding collisions is very difficult
9/21/2006

9. Requirements for MACs Should take into account the types of attacks
Need the MAC to satisfy the following:
knowing a message and MAC, it is infeasible to find another message with same MAC
MACs should be uniformly distributed
MAC should depend equally on all bits of the message
9/21/2006

10. Using Symmetric Ciphers for MAC
Can use any block cipher chaining mode and use final block as a MAC
Data Authentication Algorithm (DAA) is a widely used MAC based on DES-CBC
using IV=0 and zero-pad of final block
encrypt message using DES in CBC mode
and send just the final block as the MAC
or the leftmost M bits (16≤M≤64) of final block
But final MAC is now too small for security
9/21/2006

11. Hash Functions Condense arbitrary message to fixed size
Usually assume that the hash function is public and not keyed
Hash value is used to detect changes to message
Can use in various ways with message
Most often to create a digital signature
9/21/2006

12. Uses of Hash Functions
9/21/2006

13. Uses of Hash Functions
9/21/2006

14. Hash Function Properties
Hash function produces a fingerprint of some file/message/data
h = H(M)
condenses a variable-length message M
to a fixed-sized fingerprint
Assumed to be public
9/21/2006

15. Requirements for Hash Functions
can be applied to any sized message M
produce fixed-length output h
easy to compute h=H(M) for any message M
one-way property: given h is infeasible to find x s.t. H(x)=h
weak collision resistance: given x, is infeasible to find y s.t. H(y)=H(x)
strong collision resistance: infeasible to find any x,y s.t. H(y)=H(x)
9/21/2006

16. Simple Hash Functions Several proposals for simple functions
Based on XOR of message blocks
Not secure since can manipulate any message and either not change hash or change hash also
Need a stronger cryptographic function
9/21/2006

17. Block Ciphers as Hash Functions
Can use block ciphers as hash functions
use H0=0 and zero-pad of final block
compute Hi = EMi [Hi-1]
use final block as the hash value
similar to CBC but without a key
Resulting hash is too small (64-bit)
both due to direct birthday attack and to “meet-in-the-middle” attack
Other variants also susceptible to attack
9/21/2006

18. Birthday Attacks Might think a 64-bit hash is secure
However by Birthday Paradox is not
Birthday attack works as follows
given hash code length is m, adversary generates 2m/2 variations of a valid message all with essentially the same meaning
adversary also generates 2m/2 variations of a desired fraudulent message
two sets of messages are compared to find pair with same hash (probability > 0.5 by birthday paradox)
have user sign the valid message, then substitute the forgery which will have a valid signature
If 64-bit hash code is used, level of attack effort is only on the order of 232
9/21/2006

19. Hash Algorithm Structure
Most important modern hash functions follow the basic structure shown in this figure, Stallings Figure This has proved to be a fundamentally sound structure, and newer designs simply refine the structure and add to the hash code length. Within this basic structure, two approaches have been followed in the design of the compression function, as mentioned previously, which is the basic building block of the hash function.
9/21/2006

20. MD5 Designed by Ronald Rivest (the R in RSA)
Latest in a series of MD2, MD4
Produce a hash value of 128 bits (16 bytes)
Was the most widely used hash algorithm
in recent times have both brute-force and cryptanalytic concerns
Specified as Internet standard RFC1321
9/21/2006

21. Security of MD5 MD5 hash is dependent on all message bits
Rivest claims security is good as can be
However known attacks include
Berson in 1992 attacked any 1 round using differential cryptanalysis (but can’t extend)
Boer & Bosselaers in 1993 found a pseudo collision (again unable to extend)
Dobbertin in 1996 created collisions on MD compression function (but initial constants prevent exploit)
Wang et al announced cracking MD5 on Aug 17, 2004 (paper available on Useful Links)
Thus MD5 has become vulnerable
9/21/2006

22. Secure Hash Algorithm SHA originally designed by NIST & NSA in 1993
Was revised in 1995 as SHA-1
US standard for use with DSA signature scheme
standard is FIPS , also Internet RFC3174
Based on design of MD4 with key differences
Produces 160-bit hash values
Recent 2005 results (Wang et al) on security of SHA-1 have raised concerns on its use in future applications
The Secure Hash Algorithm (SHA) was developed by the National Institute of Standards and Technology (NIST) and published as a federal information processing standard (FIPS 180) in 1993; a revised version was issued as FIPS in 1995 and is generally referred to as SHA-1. The actual standards document is entitled Secure Hash Standard. SHA is based on the hash function MD4 and its design closely models MD4. SHA-1 produces a hash value of 160 bits. In 2005, a research team described an attack in which two separate messages could be found that deliver the same SHA-1 hash using 2^69 operations, far fewer than the 2^80 operations previously thought needed to find a collision with an SHA-1 hash [WANG05]. This result should hasten the transition to newer, longer versions of SHA.
9/21/2006

23. Revised Secure Hash Standard
NIST issued revision FIPS in 2002
Adds 3 additional versions of SHA
SHA-256, SHA-384, SHA-512
Designed for compatibility with increased security provided by the AES cipher
Structure and detail similar to SHA-1
Hence analysis should be similar
But security levels are rather higher
In 2002, NIST produced a revised version of the standard, FIPS 180-2, that defined three new versions of SHA, with hash value lengths of 256, 384, and 512 bits, known as SHA-256, SHA-384, and SHA-512. These new versions have the same underlying structure and use the same types of modular arithmetic and logical binary operations as SHA-1, hence analyses should be similar. In 2005, NIST announced the intention to phase out approval of SHA-1 and move to a reliance on the other SHA versions by See Stallings Table12.1 for comparative details of these algorithms.
9/21/2006

24. SHA-512 Overview pad message so its length is 896 mod 1024
padding length between 1 and 1024
append a 128-bit length value to message
initialize 8 64-bit registers (A,B,C,D,E,F,G,H)
process message in 1024-bit blocks:
expand bit words into 80 words by mixing & shifting
80 rounds of operations on message block & buffer
add output to input to form new buffer value
output hash value is the final buffer value
9/21/2006

25. SHA-512 Overview
Now examine the structure of SHA-512, noting that the other versions are quite similar.
SHA-512 follows the structure depicted in Stallings Figure The processing consists of the following steps:
• Step 1: Append padding bits
• Step 2: Append length
• Step 3: Initialize hash buffer
• Step 4: Process the message in 1024-bit (128-word) blocks, which forms the heart of the algorithm
• Step 5: Output the final state value as the resulting hash
See text for details.
9/21/2006

26. SHA-512 Compression Function
Heart of the algorithm
Processing message in 1024-bit blocks
Consists of 80 rounds
updating a 512-bit buffer
using a 64-bit value Wt derived from the current message block
and a round constant based on cube root of first 80 prime numbers
The SHA-512 Compression Function is the heart of the algorithm. In this Step 4, it processes the message in 1024-bit (128-word) blocks, using a module that consists of 80 rounds, labeled F in Stallings Figure 12, as shown in Figure Each round takes as input the 512-bit buffer value, and updates the contents of the buffer. Each round t makes use of a 64-bit value Wt derived using a message schedule from the current 1024-bit block being processed. Each round also makes use of an additive constant Kt, based on the fractional parts of the cube roots of the first eighty prime numbers. The output of the eightieth round is added to the input to the first round to produce the final hash value for this message block, which forms the input to the next iteration of this compression function, as shown on the previous slide.
9/21/2006

27. SHA-512 Round Function
The structure of each of the 80 rounds is shown in Stallings Figure Each 64-bit word shuffled along one place, and in some cases manipulated using a series of simple logical functions (ANDs, NOTs, ORs, XORs, ROTates), in order to provide the avalanche & completeness properties of the hash function. The elements are:
Ch(e,f,g) = (e AND f) XOR (NOT e AND g)
Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c)
∑(a) = ROTR(a,28) XOR ROTR(a,34) XOR ROTR(a,39)
∑(e) = ROTR(e,14) XOR ROTR(e,18) XOR ROTR(e,41)
+ = addition modulo 2^64
Kt = a 64-bit additive constant
Wt = a 64-bit word derived from the current 512-bit input block.
9/21/2006

28. SHA-512 Round Function
Stallings Figure 12.4 details how the 64-bit word values Wt are derived from the 1024-bit message. The first 16 values of Wt are taken directly from the 16 words of the current block. The remaining values are defined as a function of the earlier values using ROTates, SHIFTs and XORs as shown. The function elements are:
∂0(x) = ROTR(x,1) XOR ROTR(x,8) XOR SHR(x,7)
∂1(x) = ROTR(x,19) XOR ROTR(x,61) XOR SHR(x,6).
9/21/2006

29. Whirlpool Endorsed by European NESSIE project
Uses modified AES internals as compression function
Addressing concerns on use of block ciphers seen previously
With performance comparable to dedicated algorithms like SHA
Next examine the hash function Whirlpool [BARR03]. Whirlpool is one of only two hash functions endorsed by the NESSIE (New European Schemes for Signatures, Integrity, and Encryption) project, a European Union–sponsored effort to put forward a portfolio of strong cryptographic primitives of various types. Whirlpool is based on the use of a modified AES block cipher as the compression function, and is intended to provide security and performance that is comparable, if not better, than that found in non block-cipher based hash functions, such as the MD or SHA families.
9/21/2006

30. Whirlpool Overview
Stallings Figure 12.6 shows an overview of Whirlpool, which takes as input a message with a maximum length of less than 2^256 bits and produces as output a 512-bit message digest. The input is processed in 512-bit blocks. The processing consists of the following steps:
• Step 1: Append padding bits
• Step 2: Append length
• Step 3: Initialize hash matrix
• Step 4: Process message in 512-bit (64-byte) blocks, using as its core, the block cipher W.
9/21/2006

31. Whirlpool Block Cipher W
Designed specifically for hash function use
With security and efficiency of AES
But with 512-bit block size and hence hash
Similar structure & functions as AES but
input is mapped row wise
has 10 rounds
a different primitive polynomial for GF(2^8)
uses different S-box design & values
Unlike virtually all other proposals for a block-cipher-based hash function, Whirlpool uses a block cipher that is specifically designed for use in the hash function and that is unlikely ever to be used as a standalone encryption function. The reason for this is that the designers wanted to make use of an block cipher with the security and efficiency of AES but with a hash length that provided a potential security equal to SHA-512. The result is the block cipher W, which has a similar structure and uses the same elementary functions as AES, but which uses a block size and a key size of 512 bits. See Stallings Table12.2 which compares AES and W.
9/21/2006

32. Whirlpool Block Cipher W
Stallings Figure 12.7 shows the structure of Block Cipher W. The encryption algorithm takes a 512-bit block of plaintext as input and a 512-bit key and produces a 512-bit block of ciphertext as output. The encryption algorithm involves the use of four different functions, or transformations: add key (AK), substitute bytes (SB), shift columns (SC), and mix rows (MR). Note that the input is mapped by rows (unlike AES which is mapped by column). Hence the use of “Mix Rows” as the diffusion layer; and “Shift Columns” as the permutation (vs Mix Columns & Shift Rows in AES). Note also that the Key Schedule uses the same W round function, but with round constants RC[I] (being S-box outputs) taking the role of “subkeys” in the AddKey function.
9/21/2006

33. Whirlpool Performance & Security
Whirlpool is a very new proposal
Hence little experience with use
But many AES findings should apply
Does seem to need more h/w than SHA, but with better resulting performance in terms of throughput
Whirlpool is a very new proposal, hence there is little experience with use, though many AES findings should apply to it. As yet, there has been little implementation experience with Whirlpool. One study [KITS04] compared Whirlpool with a number of other secure hash functions. The authors developed multiple hardware implementations of each hash function and concluded that, compared to SHA-512, Whirlpool requires more hardware resources but performs much better in terms of throughput.
9/21/2006

34. Security of Hash Functions and MAC
Brute-force attacks
strong collision resistance hash have cost 2m/2
have proposal for hardware MD5 cracker
128-bit hash looks vulnerable, 160-bit better
MACs with known message-MAC pairs
can either attack keyspace or MAC
at least 128-bit MAC is needed for security
9/21/2006

35. Security of Hash Functions and MAC
Cryptanalytic attacks exploit structure
like block ciphers want brute-force attacks to be the best alternative
Have a number of analytic attacks on iterated hash functions
CVi = f[CVi-1, Mi]; H(M)=CVN
typically focus on collisions in function f
like block ciphers is often composed of rounds
attacks exploit properties of round functions
9/21/2006

36. Keyed Hash Functions as MACs
Desirable to create a MAC using a hash function rather than a block cipher
hash functions are generally faster
not limited by export controls on block ciphers
Hash includes a key along with the message
Original proposal:
KeyedHash = Hash(Key|Message)
some weaknesses were found with this proposal
Eventually led to development of HMAC
9/21/2006

37. HMAC Specified as Internet standard RFC2104
Use hash function on the message:
HMACK = Hash[(K+ XOR opad) ||
Hash[(K+ XOR ipad)||M)]]
K+ is the key padded out to size
opad, ipad are specified padding constants
Overhead is just 3 more hash compression function calculations than the message alone needs
Any of MD5, SHA-1, RIPEMD-160 can be used
9/21/2006

38. HMAC Structure
9/21/2006

39. Security of HMAC
Security of HMAC relates to that of the underlying hash algorithm
Attacking HMAC requires either:
brute force attack on key used
birthday attack (but since keyed would need to observe a very large number of messages)
Choose hash function used based on speed versus security constraints
9/21/2006

40. Hash and MAC Algorithms
Hash Functions
condense arbitrary size message to fixed size
by processing message in blocks
through some compression function
either custom or block cipher based
Message Authentication Code (MAC)
fixed sized authenticator for some message
to provide authentication for message
by using block cipher mode or hash function
Now look at important examples of both secure hash functions and message authentication codes (MACs).
Traditionally, most hash functions that have achieved widespread use rely on a compression function specifically designed for the hash function. Another approach is to use a symmetric block cipher as the compression function.
MACs also fall into two categories: some use a hash algorithm such as SHA as the core of the MAC algorithm, others use a symmetric block cipher in a cipher block chaining mode.
9/21/2006

41. Next Class Replay attacks Timestamps and nonces Anti-replay protocols
9/21/2006