Hardness Assumptions Related to Ad-Hoc Constructions Shai Halevi February 22, 2007

Ad-hoc constructions Hash functions: MD5, SHA-x, RIPEMD, WHIRLPOOL, RadioGatún, … Block ciphers: DES, IDEA, RC5/6, Twofish, AES, Camellia, … Stream ciphers: RC4, A5/x, MUGI, Py, Rabbit, SEAL, Trivium, … Often consist of a “basic function” and a “mode of operation” around it

What conjectures to make? We know very little about the true hardness of these “ad hoc constructions” Use conjectures to fill some of the void The more the merrier Only two requirements Can be used to do something interesting* Not known to be false Sometimes we even compromise on this * Let you prove interesting theorems

Standard conjectures Block ciphers: strong PRP Hash functions: many many things Collision-resistant, 2 nd pre-image resistant, one-way, UOWHF (TCR) PRF, MAC (when keyed) Also others: hard to find pre-image of zero, hard to find “almost collisions”, hard to find fixed-points, “division-intractability”, …

“Unholy conjectures” Random oracles, Ideal ciphers What the customer wants: this is how people who build applications think of these constructs E.g., what’s wrong with E k (k)? “You proved that this is not a random oracle. That’s your problem, not ours” Unfortunately they have a point

Theory, anyone? Modes of operation Relations between notions “Weak random oracles” And beyond…

Modes of operation View constructs as a black box Results are meaningful even for idealized ciphers or hash functions E.g., DESX stronger than DES, when DES is modeled as ideal cipher [KR96] C P k3k3 k2k2 k1k1 DES

ROs and ideal ciphers Using random funcs/perms for extractors In CBC mode, HMAC mode [DGHKR04] Domain extension for ROs [CDMP05] Also building ROs from ideal-ciphers Open: building ideal ciphers from ROs Partial results in [DP06] Open: domain-extenders for ideal ciphers

Multi-property-preserving modes Prove many claims on the same mode E.g, for (a variant of) Merkle-Damgård If compression function is collision-resistant then so is the resulting hash function, If compression function is PRF then so is the resulting hash function, If compression function is a random-oracle then so is the resulting hash function, Etc.

Relations between notions So many notions, we need taxonomies

Collision-resistance vs. the world Not implied by PRPs via BB [S98] Implied by PIR, homomorphic encryption [IKO05] Surprising: collision-resistance follows from secrecy guarantees Connections to the compressibility of SAT [HN06] Equivalent to one-flow statistically-hiding commitment?

“Weak random oracles” RO-like but can actually exist At least we can’t prove that they don’t exist Not many of those: Perfect one-way hashing [C97, CMR98] AKA “point-function obfuscators” [W05] “Magic functions” [DNRS99] Sometimes can prove they do not exist [GK03]

And beyond… Theory of block ciphers? Embarrassingly lacking Luby-Rackoff [LR88] for Feistel networks? + refinement by Naor-Reingold [NR97] Dodis-Puniya [DP07] analyze Feistel with round functions weaker than PRFs Relevance to block-cipher design is a huge leap of faith

Security from round functions Block-cipher recipe: Take a sufficiently non-linear permutation Sprinkle some secret-key material Repeat sufficiently many times Get a secure cipher Moral: security comes from repetition, not so much the original round function Can we make a science of it?

Charlie’s conjecture Due to Charlie Rackoff Take “simple enough” permutation family E.g., computed in NC0 Repeat enough times to get “almost four-wise independence” The result is a PRP Can anyone disprove it?

Comments X-wise independent reminiscent of “Decorrelation theory” [V] Can’t replace 4-wise with 3-wise Otherwise it’s false Simplicity of round function is important Otherwise it’s false (e.g., if you start from a 4-wise independent permutation) The point is to have many repetitions

What can we do with Charlie? The conjecture implies that PRPs exist But PRPs with a very specific structure Do they imply CR hashing? If not: come up with a similar conjecture that implies collision-resistant hashing Or implies both PRPs and CR hashing

Summary We know very little about the true hardness of these “ad hoc constructions” Conjectures can fill some of the void The more the merrier Only two requirements Not known to be false (?) Can be used to do something interesting* * Let you prove interesting theorems

dank u