Cryptography and

Network Security
Chapter 11
Fifth Edition
by William Stallings

Lecture slides by Lawrie Brown

 Hash Functions
 condenses arbitrary message to fixed size
h = H(M)
 usuallyassume hash function is public
 hash used to detect changes to message
 want a cryptographic hash function
 computationally infeasible to find data mapping
to specific hash (one-way property)
 computationally infeasible to find two data to
same hash (collision-free property)
Cryptographic Hash Function
 Hash Function Uses
 Message Integrity Check (MIC)
 send hash of message (digest)
 MIC always encrypted, message optionally
 Message Authentication Code (MAC)
 send keyed hash of message
 MAC, message optionally encrypted
 Digital Signature (non-repudiation)
 Encrypt hash with private (signing) key
 Verify with public (verification) key
 Hash Functions & Message
Authentication
Symmetric Key
Unkeyed Hash

a) Message
encrypted

b) Message
unencrypted
 Hash Functions & Message
Authentication
Symmetric Key
Keyed Hash

a) Message
unencrypted

d) Message
encrypted
Hash Functions & Digital
Signatures - PKCS
 Other Hash Function Uses
 pseudorandom function (PRF)
 Generate session keys, nonces
 Produce key from password
 Derive keys from master key cooperatively
 pseudorandom number generator
(PRNG)
 Vernam Cipher/OTP
 S/Key, proof of “what you have” via messages
 More Hash Function Uses
 to create a one-way password file
 store hash of password not actual password
 e.g., Unix, Windows NT, etc.
 salt to deter precomputation attacks
 Rainbow tables
 for intrusion detection and virus detection
 keep & check hash of files on system
 e.g., Tripwire
Lamport One-time Passwords
 Password safety in distributed system
 server compromise does not compromise P
 interception of authentication exchange does
not compromise password either
 Alice picks Password PA
 Hashes password N times, HN(PA)
 Server stores (Alice, N, HN(PA))
 Attacker can’t get PA from HN(PA)
Lamport One-time Passwords
 Protocol
 Alice sends “I’m Alice”
 Server sends “N-1”
 Alice sends “X” where X=HN-1(PA)
 Server verifies H(X) = HN(PA)
 Server updates to (Alice, N-1, X)
 Attackerstill can’t get PA or
authenticate as Alice
Hash Function Requirements
 Simple Insecure Hash
Functions
 Let n be a large integer. Let h(m) = m (mod n) be
regarded as an integer between 0 and (n-1).

 Analyze the properties of the above hash function

 Simple Insecure Hash
Functions
 consider the following hash functions
 bit-by-bit exclusive-OR (XOR) of every block
 Ci = bi1 xor bi2 xor . . . xor bim
 a longitudinal redundancy check
 reasonably effective as data integrity check
 one-bit circular shift on hash value
 for each successive n-bit block
• rotate current hash value to left by1bit and XOR block
 good for data integrity but useless for security
 Attacks on Hash Functions
 have brute-force attacks and cryptanalysis
 a preimage or second preimage attack
 find y s.t. H(y) equals a given hash value
 collision resistance
 find two messages x & y with same hash so
H(x) = H(y)
 hence value 2m/2 determines strength of
hash code against brute-force attacks
 128-bits inadequate, 160-bits suspect
 Birthday Attacks
 might think a 64-bit hash is secure
 but by Birthday Paradox is not
 birthday attack works thus:
 given user prepared to sign a valid message x
m
 opponent generates 2 /2 variations x’ of x, all with
essentially the same meaning, and saves them
m
 opponent generates 2 /2 variations y’ of a desired
fraudulent message y
 two sets of messages are compared to find pair with
same hash (probability > 0.5 by birthday paradox)
 have user sign the valid message, then substitute the
forgery which will have a valid signature
 conclusion is that need to use larger MAC/hash
 Birthday Attacks
Find i and j
such that y y’1 y’2 … y’j … y’N
H(y’j)=H(x’i)
x ≠ ≠ ≠ ≠ ≠
Table takes x’1 ≠ ≠ ≠ ≠ ≠
O(N2) time
x’2 ≠ ≠ ≠ ≠ ≠
Faster … …
x’i ≠ ≠ ≠ = ≠
Sorted lists
take O(NlogN) …
time
x’N ≠ ≠ ≠ ≠ ≠
 Birthday Attacks
 What are chances we get a match?
 N distinct values, k randomly chosen ones
 P(N,i) = prob(i randomly selected values from
1..N have at least one match)
 P(N,2) = 1/N
 P(N,i+1) = P(N,i)+(1-P(N,i))(i/N)
 ForP(N,k)>0.5, need k ≈ N1/2
 Need double # bits in hash value
Hash Function Cryptanalysis
 cryptanalytic attacks exploit some property
of alg so faster than exhaustive search
 hash functions use iterative structure
 process message in blocks (incl length)
 attacks focus on collisions in function f
 Block Ciphers as Hash
Functions
 can use block ciphers as hash functions
 using H0=0 and zero-pad of final block
 compute: Hi = EMi [Hi-1]
 and use final block as the hash value
 similar to CBC but without a key
 resulting hash is too small (64-bit)
 both due to direct birthday attack
 and to “meet-in-the-middle” attack
 other variants also susceptible to attack
 Block Ciphers as Hash
Functions H
0
Block cipher key length B
Pad Message M to multiple of B M1 E
Break padded M into L blocks
L = |M|/B M2 E
M = M1 M2 … ML
Use blocks of M as keys in block
cipher, iteratively encrypt state value
starting with constant H0 resulting in ML E
hash value
H = HL = E(ML,….E(M2,E(M1,H0))…) HL
 Secure Hash Algorithm
 SHA originally designed by NIST & NSA in 1993
 was revised in 1995 as SHA-1
 US standard for use with DSA signature scheme
 standard is FIPS 180-1 1995, also Internet RFC3174
 nb. the algorithm is SHA, the standard is SHS
 based on design of MD4 with key differences
 produces 160-bit hash values
 2005 results on security of SHA-1 raised
concerns on its use in future applications
 Revised Secure Hash
Standard
 NIST issued revision FIPS 180-2 in 2002
 adds 3 additional versions of SHA
 SHA-256, SHA-384, SHA-512
 designed for compatibility with increased
security provided by the AES cipher
 structure & detail is similar to SHA-1
 hence analysis should be similar
 but security levels are rather higher
SHA Versions
SHA-512 Overview
 SHA-512 Compression
Function
 heartof the algorithm
 processing message in 1024-bit blocks
 consists of 80 rounds
 updating a 512-bit buffer
 using a 64-bit value Wt derived from the
current message block
 and a round constant based on cube root of
first 80 prime numbers
SHA-512 Round Function
SHA-512 Round Function
 SHA-3
 SHA-1 not yet "broken”
 but similar to broken MD5 & SHA-0
 so considered insecure
 SHA-2 (esp. SHA-512) seems secure
 shares same structure and mathematical
operations as predecessors so have concern
 NIST announced in 2007 a competition for
the SHA-3 next gen NIST hash function
 Keccak winner Oct 2012 – std in Q2,2014
 SHA-3 Requirements
 replace SHA-2 with SHA-3 in any use
 so use same hash sizes
 preserve the online nature of SHA-2
 so must process small blocks (512 / 1024 bits)
 evaluation criteria
 security close to theoretical max for hash sizes
 cost in time & memory
 characteristics: such as flexibility & simplicity
 Summary
 have considered:
 hash functions
• uses, requirements, security
 hash functions based on block ciphers
 SHA-1, SHA-2, SHA-3