1. Information Security and Management 11. Cryptographic Hash Functions Chih-Hung Wang Fall 2011 1

2. Definition ▫A hash function accepts a variable-size message M as input and produces a fixed-size hash code H(M) ▫Sometime called a message digest ▫Hash Algorithm  MD5  RFC 1321 developed by Ron Rivist at MIT  Secure Hash Algorithm (SHA)  FIPS PUB 180 in 1993 (NIST) 180-1 in 1995  FISP: Federal Information Processing Standard 2 Hash Function

3. 3 Plaintext M Message Digest Hash value H(M)

4.  H can be applied to a block of data of any size  H produces a fixed-length output  H(x) is relatively easy to compute for any given x, making both hardware and software implementations practical  For any given code h, it is computationally infeasible to find x such that H(x)=h. This is sometimes referred to in the literature as the one-way property  For any given block x, it is computationally infeasible to find y  x with H(y)=H(x). This is sometimes referred to as weak collision resistance  It is computationally infeasible to find any pair (x,y) such that H(x)=H(y). This is sometimes referred to as strong collision resistance. 4 Requirements of Hash

5. 5 m1m1 m2m2 H(m 1 ) H(m 2 ) It is difficult to find m1 and m2 (m1  m2) such that H(m1)=H(m2)

6. 6 Basic Use of Hash (A)

7. 7 Basic Use of Hash (B)

8. 8 Basic Use of Hash (C)

9. For a code of length n ▫One-way: 2 n ▫Weak collision resistance: 2 n ▫Strong collision resistance: 2 n/2 9 Security of Hash Functions

10. MD5 SHA 10 The Famous Hash Functions

11. 1.Append padding bits: pad message so its length is 448 mod 512 2.Append length: append a 64-bit length value to message 3.Initialize MD buffer: initialise 5-word (160-bit) buffer (A,B,C,D,E) to (67452301,efcdab89,98badcfe,10325476,c3d2e1f0) 4.Process message in 512-bit (16-word) blocks: ▫expand 16 words into 80 words by mixing & shifting ▫use 4 rounds of 20 bit operations on message block & buffer ▫add output to input to form new buffer value 5.Output: output hash value is the final buffer value 11 SHA-1 Logic

12. Each round has 20 steps which replaces the 5 buffer words thus: (A,B,C,D,E) <-(E+f(t,B,C,D)+S 5 (A)+Wt+Kt),A,S 30 (B),C,D) A,B,C,D,E refer to the 5 words of the buffer t is the step number, 0  t  79 f(t,B,C,D) is nonlinear function for round W t is derived from the message block K t is an additive constant value S k is circular left shift by k bits 12 SHA-1 Compression Function

13. 13 SHA-1 Compression Function

14. 14 SHA-1 Compression Function

15. 15 Function Summarized

16. 80-word Input Sequence W t =S 1 (W t-16  W t-14  W t-8  W t-3 ) 16

17. SHA 512 17

18. SHA 512(a single 1024- bit block) 18

19. SHA 512 (Elementary operation) 19

20. SHA 512 (Creation of 80-word input sequence) 20

21. Brute force attack for SHA-1 is harder (160 vs 128 bits for MD5) SHA-1 is not vulnerable to any known attacks (compared to MD4/5) ?? (Speed) SHA-1 is a little slower than MD5 (80 vs 64 steps) Both designed is simple and compact SHA-1 uses big endian scheme (MD5 uses little endian scheme) 21 Comparison of SHA-1 and MD5

22. NIST have issued a revision FIPS 180-2 and adds 3 additional hash algorithms: SHA-256, SHA-384, SHA-512. Designed for compatibility with increased security provided by the AES cipher Structure & detail are similar to SHA-1 and hence analysis should be similar. 22 Revised Secure Hash Standard

23. 23 Comparison of SHA Properties