Cryptography and Network Security

(1)

Cryptography and

Network Security

Chapter 11

Fifth Edition

by William Stallings

(2)

Chapter 11 – Cryptographic

Hash Functions

Each of the messages, like each one he had ever Each of the messages, like each one he had ever

read of Stern's commands, began with a number read of Stern's commands, began with a number and ended with a number or row of numbers. No and ended with a number or row of numbers. No efforts on the part of Mungo or any of his experts efforts on the part of Mungo or any of his experts

had been able to break Stern's code, nor was had been able to break Stern's code, nor was

there any clue as to what the preliminary number there any clue as to what the preliminary number

and those ultimate numbers signified. and those ultimate numbers signified.

—

(3)

Hash Functions



_{condenses arbitrary message to fixed size}

h = H(M)



_{usually assume hash function is public}



_{hash used to detect changes to message}



_{want a cryptographic hash function}

computationally infeasible to find data mapping _{computationally infeasible to find data mapping} to specific hash (one-way property)

to specific hash (one-way property)

computationally infeasible to find two data to _{computationally infeasible to find two data to} same hash (collision-free property)

(4)

(5)

Hash Function Uses



_{Message Integrity Check (MIC)}

_{send hash of message (digest)}_{send hash of message (digest)}

MIC always encrypted, message optionally_{MIC always encrypted, message optionally}



_{Message Authentication Code (MAC)}

_{send keyed hash of message}_{send keyed hash of message}

_{MAC, message optionally encrypted}_{MAC, message optionally encrypted}



_{Digital Signature (non-repudiation)}

Encrypt hash with private (signing) key_{Encrypt hash with private (signing) key}

(6)

Hash Functions & Message

Authentication

Symmetric Key

Unkeyed Hash

a) Message encrypted

(7)

Hash Functions & Message

Authentication

Symmetric Key

Keyed Hash

a) Message unencrypted

(8)

Hash Functions & Digital

Signatures - PKCS

(9)

Other Hash Function Uses



_{pseudorandom function (PRF)}

_{Generate session keys, nonces}_{Generate session keys, nonces} Produce key from password_{Produce key from password}

Derive keys from master key cooperatively_{Derive keys from master key cooperatively}



_{pseudorandom number generator}

(PRNG)

Vernam Cipher/OTP_{Vernam Cipher/OTP}

(10)

More Hash Function Uses



_{to create a one-way password file}

store hash of password not actual _{store hash of password not actual}passwordpassword

e.g., Unix, Windows NT, etc._{e.g., Unix, Windows NT, etc.}

salt to deter precomputation attacks_{salt to deter precomputation attacks}

_{Rainbow tables}_{Rainbow tables}



_{for intrusion detection and virus detection}

keep & check hash of files on system_{keep & check hash of files on system}

(11)

Lamport One-time Passwords



_{Password safety in distributed system}

_{server compromise does not compromise P}_{server compromise does not compromise P} interception of authentication exchange does _{interception of authentication exchange does}

not compromise password either not compromise password either



Alice picks Password P

_A_A

Hashes password N times, HHashes password N times, HNN(P_(P A

A))

Server stores (Alice, N, HServer stores (Alice, N, HNN(P_(P A

A))))

Attacker can’t get PAttacker can’t get P_A_A from H from HNN(P_(P A

(12)

Lamport One-time Passwords



_Protocol

_{Alice sends “I’m Alice”}_{Alice sends “I’m Alice”} Server sends “N-1”_{Server sends “N-1”}

Alice sends “X” where X=HAlice sends “X” where X=HN-1N-1(P_(P A

A))

Server verifies H(X) = HServer verifies H(X) = HNN(P_(P A

A))

Server updates to (Alice, N-1, X)_{Server updates to (Alice, N-1, X)}



Attacker still can’t get P

_A_A

or

authenticate as Alice

(13)

Two Simple Insecure Hash

Functions



_{consider two simple insecure hash functions}



_{bit-by-bit exclusive-OR (XOR) of every block}

CC_i_i = b = b_i1_i1 xor b xor b_i2_i2 xor . . . xor b xor . . . xor b_im_im

a longitudinal redundancy check_{a longitudinal redundancy check}

reasonably effective as data integrity check_{reasonably effective as data integrity check}



_{one-bit circular shift on hash value}

for each successive _{for each successive}n-bit n-bit blockblock

• rotate current hash value to left by1bit and XOR block_{rotate current hash value to left by1bit and XOR block}

(14)

Hash Function Requirements

(15)

Attacks on Hash Functions



_{have brute-force attacks and cryptanalysis}



_{a preimage or second preimage attack}

find _find_y_y s.t. s.t. _H(y)_H(y)equals a given hash value equals a given hash value



_{collision resistance}

_{find two messages}_{find two messages}_x_x_&_&_y_y _{with same hash so}_{with same hash so}

H(x) = H(y)



_{hence value 2}

m/2 m/2

determines strength of

_{determines strength of}

hash code against brute-force attacks

(16)

Birthday Attacks

 _{might think a 64-bit hash is secure}_{might think a 64-bit hash is secure}  but by _{but by}Birthday ParadoxBirthday Paradox is not is not

 birthday attack _{birthday attack}works thus:works thus:

 given user prepared to sign a valid message x_{given user prepared to sign a valid message x}

 _{opponent generates 2}_{opponent generates 2}mm//₂₂_{variations x’ of x, all with}_{variations x’ of x, all with}

essentially the same meaning, and saves them

 _{opponent generates 2}_{opponent generates 2}mm//₂₂_{variations y’ of a desired}_{variations y’ of a desired}

fraudulent message y

 two sets of messages are compared to find pair with _{two sets of messages are compared to find pair with}

same hash (probability > 0.5 by birthday paradox)

 have user sign the valid message, then substitute the _{have user sign the valid message, then substitute the}

forgery which will have a valid signature

(17)

Birthday Attacks

y _y’_y’₁₁ _y’_y’₂₂ … _y’_y’_j_j … _y’_y’_N_N x

x ≠ ≠ ≠ ≠ ≠

x’

x’₁₁ ≠ ≠ ≠ ≠ ≠

x’

x’₂₂ ≠ ≠ ≠ ≠ ≠

… x’

x’_i_i ≠ ≠ ≠

=

≠

… x’

x’_N_N ≠ ≠ ≠ ≠ ≠

Find i and j such that H(y’_j)=H(x’_i)

Table takes O(N2_{) time}

Faster …

Sorted lists

(18)

Birthday Attacks



_{What are chances we get a match?}



_{N distinct values, k randomly chosen ones}

P(N,i) = prob(i randomly selected values from _{P(N,i) = prob(i randomly selected values from} 1..N have at least one match)

1..N have at least one match)

P(N,2) = 1/N_{P(N,2) = 1/N}

P(N,i+1) = P(N,i)+(1-P(N,i))(i/N)_{P(N,i+1) = P(N,i)+(1-P(N,i))(i/N)}



_{For P(N,k)>0.5, need k}

_≈

_N

1/2 1/2

(19)

Hash Function Cryptanalysis



_{cryptanalytic attacks exploit some property}

of alg so faster than exhaustive search



_{hash functions use iterative structure}

_{process message in blocks (incl length)}_{process message in blocks (incl length)}

(20)

Block Ciphers as Hash

Functions



_{can use block ciphers as hash functions}

using Husing H₀₀=0 and zero-pad of final block=0 and zero-pad of final block

compute: Hcompute: H_i_i = E = E_M_M_i_i [H [H_i-1_i-1]]

and use final block as the hash value_{and use final block as the hash value}

similar to CBC but without a key_{similar to CBC but without a key}



_{resulting hash is too small (64-bit)}

both due to direct birthday attack_{both due to direct birthday attack}

and to “meet-in-the-middle” attack_{and to “meet-in-the-middle” attack}

(21)

Block Ciphers as Hash

Functions

E M₁ H0 E M₂ E M_L HL

Block cipher key length B

Pad Message M to multiple of B Break padded M into L blocks L = |M|/B

M = M₁ M₂ … M_L

Use blocks of M as keys in block

cipher, iteratively encrypt state value starting with constant H₀ resulting in hash value

(22)

Secure Hash Algorithm

 _{SHA originally designed by NIST & NSA in 1993}_{SHA originally designed by NIST & NSA in 1993}  was revised in 1995 as SHA-1_{was revised in 1995 as SHA-1}

 US standard for use with DSA signature scheme _{US standard for use with DSA signature scheme}

 standard is FIPS 180-1 1995, also Internet RFC3174_{standard is FIPS 180-1 1995, also Internet RFC3174}

 nb. the algorithm is SHA, the standard is SHS _{nb. the algorithm is SHA, the standard is SHS}

 based on design of MD4 with key differences _{based on design of MD4 with key differences}

 produces 160-bit hash values _{produces 160-bit hash values}

(23)

Revised Secure Hash

Standard



_{NIST issued revision FIPS 180-2 in 2002}



adds 3 additional versions of SHA

_{adds 3 additional versions of SHA}

SHA-256, SHA-384, SHA-512_{SHA-256, SHA-384, SHA-512}



_{designed for compatibility with increased}

security provided by the AES cipher



structure & detail is similar to SHA-1

_{structure & detail is similar to SHA-1}



hence analysis should be similar

_{hence analysis should be similar}

(24)

(25)

(26)

SHA-512 Compression

Function



_{heart of the algorithm}



_{processing message in 1024-bit blocks}



_{consists of 80 rounds}

_{updating a 512-bit buffer}_{updating a 512-bit buffer}

using a 64-bit value Wt derived from the _{using a 64-bit value Wt derived from the} current message block

current message block

_{and a round constant based on cube root of}_{and a round constant based on cube root of}

(27)

(28)

SHA-512

(29)

SHA-3



_{SHA-1 not yet "broken”}

but similar to broken MD5 & SHA-0_{but similar to broken MD5 & SHA-0}

so considered insecure_{so considered insecure}



_{SHA-2 (esp. SHA-512) seems secure}

shares same structure and mathematical _{shares same structure and mathematical}

operations as predecessors so have concern operations as predecessors so have concern



_{NIST announced in 2007 a competition for}

the SHA-3 next gen NIST hash function

(30)

SHA-3 Requirements



_{replace SHA-2 with SHA-3 in any use}

so use same hash sizes_{so use same hash sizes}



_{preserve the online nature of SHA-2}

so must process small blocks (512 / 1024 bits)_{so must process small blocks (512 / 1024 bits)}



_{evaluation criteria}

security close to theoretical max for hash sizes_{security close to theoretical max for hash sizes}

cost in time & memory _{cost in time & memory}

(31)

Summary



_{have considered:}

hash functions_{hash functions}

• uses, requirements, security_{uses, requirements, security}