Presentation is loading. Please wait.

Presentation is loading. Please wait.

CS/ECE 478 Introduction to Network Security Dr. Attila Altay Yavuz

Similar presentations


Presentation on theme: "CS/ECE 478 Introduction to Network Security Dr. Attila Altay Yavuz"— Presentation transcript:

1 CS/ECE 478 Introduction to Network Security Dr. Attila Altay Yavuz
Cryptographic Hash Functions Credit: Prof. Dr. Peng Ning Dr. Shai Halevi Dr. Attila Altay Yavuz

2 Hash Function Properties
Advanced Network Security Dr. Attila Altay Yavuz

3 Hash Function Also known as
Message of arbitrary length A fixed-length short message Hash Also known as Message digest One-way transformation One-way function Hash Length of H(m) much shorter then length of m Usually fixed lengths: 160 or 256 bits (preferred)

4 How are they built? … Typically using Merkle-Damgård iteration:
But not always… Typically using Merkle-Damgård iteration: Start from a “compression function” h: {0,1}b+n{0,1}n Iterate it |M|=b=512 bits h c =160 bits d=h(c,M)=160 bits h M1 M2 ML-1 ML IV=d0 d1 d2 dL-1 dL d=H(M)

5 What are they good for? “Modern, collision resistant hash functions were designed to create small, fixed size message digests so that a digest could act as a proxy for a possibly very large variable length message in a digital signature algorithm, such as RSA or DSA. These hash functions have since been widely used for many other “ancillary” applications, including hash-based message authentication codes, pseudo random number generators, and key derivation functions.” “Request for Candidate Algorithm Nominations”, -- NIST

6 Desirable Properties of Hash Functions
Consider a hash function H Performance: Easy to compute H(m) One-way property: Given H(m) but not m, it’s computationally infeasible to find m Weak collision resistance: Given H(m), it’s computationally infeasible to find m’ such that H(m’) = H(m). Strong collision resistance: Computationally infeasible to find m1, m2 such that H(m1) = H(m2)

7 Length of Hash Image Question
Why do we have 160 bits or 256 bits in the output of a hash function? If it is too long Unnecessary overhead If it is too short Birthday paradox Loss of strong collision property

8 Birthday Paradox (Cont’d)
Implication for hash function H of length m With probability at least 0.5 If we hash about 2m/2 random inputs, Two messages will have the same hash image Birthday attack Conclusion Choose m  160, preferable m  256

9 Hash Function Use and Applications
Network Security Dr. Attila Altay Yavuz

10 Using “imperfect” hash functions
Applications should rely only on “specific security properties” of hash functions Try to make these properties as “standard” and as weak as possible Increases the odds of long-term security When weaknesses are found in hash function, application more likely to survive E.g., MD5 is badly broken, but HMAC-MD5 is barely scratched

11 Security requirements
Deterministic hashing Attacker chooses M, d=H(M) Hashing with a random salt Attacker chooses M, then good guy chooses public salt, d=H(salt,M) Hashing random messages Given M, d=H(M’) e.g., M’=M||r Hashing with a secret key Attacker chooses M, d=H(key,M) Stronger Weaker

12 Deterministic hashing
Collision Resistance Attacker cannot find M,M’ such that H(M)=H(M’) Also many other properties Hard to find fixed-points, near-collisions, M s.t. H(M) has low Hamming weight, etc.

13 Hashing with public salt
Target-Collision-Resistance (TCR) Attacker chooses M, then given random salt, cannot find M’ such that H(salt,M)=H(salt,M’) enhanced TRC (eTCR) Attacker chooses M, then given random salt, cannot find M’,salt’ s.t. H(salt,M)=H(salt’,M’)

14 Hashing random messages
Second Preimage Resistance Given random M, attacker cannot find M’ such that H(M)=H(M’) One-wayness Given d=H(M) for random M, attacker cannot find M’ such that H(M’)=d Extraction For random salt, high-entropy M, the digest d=H(salt,M) is close to being uniform

15 Hashing with a secret key
Pseudo-Random Functions The mapping MH(key,M) for secret key looks random to an attacker

16 Application 1: Digital signatures
Hash-then-sign paradigm First shorten the message, d = H(M) Then sign the digest, s = SIGN(d) Relies on collision resistance If H(M)=H(M’) then s is a signature on both  Attacks on MD5, SHA-1 threaten current signatures MD5 attacks can be used to get bad CA cert [Stevens et al. 2009]

17 Application: Digital Signatures
Generating a signature H(m) Message m Signature (encrypted hash) Hash Sign Bob’s Private key Message m Hash H(m) Verify Bob’s Public key Signature Valid / Not Valid Verifying a signature File and user authenticity in one shot! Only one party (Bob) knows the private key

18 Collision resistance is hard
Attacker works off-line (find M,M’) Can use state-of-the-art cryptanalysis, as much computation power as it can gather, without being detected !! Helped by birthday attack (e.g., 280 vs 2160) Well worth the effort One collision  forgery for any signer

19 Signatures without CRHF
[Naor-Yung 1989, Bellare-Rogaway 1997] Use randomized hashing To sign M, first choose fresh random salt Set d= H(salt, M), s= SIGN( salt || d ) Attack scenario (collision game): Attacker chooses M Signer chooses random salt Attacker must find M' s.t. H(salt,M) = H(salt,M') Attack is inherently on-line Only rely on target collision resistance same salt (since salt is explicitly signed)

20 TCR hashing for signatures
Not every randomization works H(M|salt) may be subject to collision attacks when H is Merkle-Damgård Yet this is what PSS does (and it’s provable in the ROM) Many constructions “in principle” From any one-way function Some engineering challenges Most constructions use long/variable-size randomness, don’t preserve Merkle-Damgård Also, signing salt means changing the underlying signature schemes

21 The Hashed Message Authentication Code (HMAC)
Attila Altay Yavuz

22 Authentication with HMAC
[Bellare-Canetti-Krawczyk 1996] Simple key-prepend/append have problems when used with a Merkle-Damgård hash tag=H(key | M) subject to extension attacks HMAC: Compute tag = H(key || H(key || M)) About as fast as key-prepend for a MD hash Relies only on PRF quality of hash MH(key|M) looks random when key is secret

23 HMAC Processing   Key K 0x363636…36 Message M 0x5c5c5c…5c
pad on right with 0’s to 512 bits in length 0x5c5c5c…5c HMAC(key,message) compute message digest concatenate Message M concatenate compute message digest CSC/ECE 574 Dr. Peng Ning

24 Is Encryption a Good Hash Function?
constant M1 M2 M3 M4 E E E E 64 Hash Building hash using block chaining techniques Encryption block size may be too short (DES=64) Birthday attack Extension attacks

25 Modern Hash Functions MD5 SHA-1 SHA-256, SHA-384, …
Previous versions (i.e., MD2, MD4) have weaknesses. Broken; collisions published in August 2004 Too weak to be used for serious applications SHA-1 Broken: Both in theory and with real-attack Collisions in 269 hash operations, much less than the brute-force attack of 280 operations CRYPTO ’05 SHA-256, SHA-384, … BLAKE-256/512 (good for embedded devices)

26 (In)security of MD5 A few recently discovered methods can find collisions in a few hours A few collisions were published in 2004 Can find many collisions for 1024-bit messages More discoveries afterwards In 2005, two X.509 certificates with different public keys and the same MD5 hash were constructed This method is based on differential analysis 8 hours on a 1.6GHz computer Much faster than birthday attack

27 Summary Hashing is fast to compute
Has many applications (some making use of a secret key) Hash images must be at least 160 bits long but longer is better  256 is ideal Hash function details are tedious  HMAC protects message digests from extension attacks


Download ppt "CS/ECE 478 Introduction to Network Security Dr. Attila Altay Yavuz"

Similar presentations


Ads by Google