1. ICS 454 Principles of Cryptography
Secure Hashing
and DSS
Sultan Almuhammadi

2. Outline One-way functions Secure Hash function
Authentication (example)
Digital Signature Standards (DSS)

3. Definitions One-way function f :AB Trapdoor one-way function
Given x  A, it is easy to compute f (x)
Given f (x), it is hard to compute x
Trapdoor one-way function
A one-way function f :A  B with a secret s, such that
Given f (x) and s, it is easy to compute x

4. Examples One-way function Trapdoor one-way function
Multipicative group Zp* with generator g
f (x) = gx mod p
Trapdoor one-way function
Multiplicative group Zn* where n = p.q for primes p,q
f (x) = x2 mod n
The secret is: (p and q)

5. Hash Function Definition: one-way hash function h(x)
A one-way hash function operates on an input message x of arbitrary length, and outputs a fixed-length hash value h(x).
Given x, it is easy to compute h(x)
Given h(x), it is infeasible to compute x

6. Hash Function Properties
h can be applied to an input of any size
h produces a fixed-length output
One-way property: Easy to compute h(x), but infeasible to compute x given h(x) (Preimage resistance)
Collision resistance property:
Weakly collision-free: Given x, it is infeasible to find y  x, such that h(x) = h(y) (Second preimage resistance)
Strongly collision-free: It is infeasible to find any pair (x, y) such that y  x and h(x) = h(y) (Collision resistance)

7. Secure Hashing
Definition: h is cryptographically secure if it is a one-way collision-free hash function.
Note: Strong/weak collision resistance depends on the sensitivity of the application
Given a message M, h(M) is called the hash value of M , hash code, or the message digest.
Examples: SHA, MD4, MD5, Whirlpool

8. Security of Hash Functions
Effort Required for Brute-Force Attack (on average)
One way
2n-1
Weak collision resistance
Strong collision resistance
2n/2

9. General Structure of Secure Hashing

10. Secure Hash Algorithm (SHA)
Developed by National Institute of Standards and Technology (NIST) in 1993.
In 1995, NIST published SHA-1
Based on MD4
Output: 160-bit hash value
In 2002, NIST defined 3 versions (SHA-256, SHA-384, SHA-512) with hash value lengths: 256, 384, and 512.
In 2005, NIST approved the phase out of SHA-1 and moving to other versions of SHA by 2010.

11. MD4 MD stands for Message Digest and designed by Ron Rivest
Output: 128-bit hash values
Design goals (claimed by Rivest)
Strongly collision-free (no attack is better than brute-foce)
The security is based on no assumption (like hardness of factorization)
MD4 was cryptanalyzed shortly after publishing and some parts were successfully attacked.

12. MD5 MD5 is an improved version of MD4 Output: 128-bit hash values
Ron Rivest made several improvements of MD5 over MD4
MD5 was cryptanalyzed but there is no practical impact on the security of the hash function

13. Whirlpool
Based on the use of a block cipher for the compression function (initially DES, later AES)
General drawbacks of using block cipher:
Block ciphers are invertible lack of randomness
Low performance due to slow block ciphers
Weakness due to regularities of block ciphers
Hash value length restriction due to block sizes: h  2b
Since the adoption of AES, Whirlpool overcomes the above drawbacks.

14. Whirlpool Advantages of using AES
Hash code length is 512 bits (same as SHA)
Resistant to usual attacks on block-cipher hashing
Good performance and compact implementation on software and hardware

15. Applications of Secure Hashing
Authentication
Digital Signature

16. Example: Authentication
Alice logs into a host computer
She identifies herself by a username and a password
The host computer stores a all username-password in a a database and check for a match.
Authentication using secure hash functions
Alice sends her password to the host
The host hashes the password and compares the hash value to the value it previously stored
If Eve steals the hash values, she still cannot log in, since the hash function is one-way and collision-free.

17. Digital Signature Standard (DSS)
Proposed by the National Institute of Standards and Technology (NIST) in 1991
DSS uses a digital signature algorithm (DSA):
Designed to provide only the digital signature function
Cannot be used for encryption or key exchange
Must be a public-key technique (publicly verifiable)
Use the SHA for hashing the message
Example of digital signature approaches:
RSA Approach
DSS Approach

18. Digital Signature Approaches (DSS vs. RSA)

19. Digital Signature Algorithm (DSA)
NIST adopted DSA based on ElGamal digital signature with the following parameters:
Prime p of length bits
160-bit prime q such that q | (p – 1)
g is of the form g = h(p-1)/q mod p
Private key: x, Public key: y = gx mod p
The signature (a, b) is computed by:
a = (gr mod p) mod q, for random r < q
b = (r-1 (SHA(M) + x.a)) mod q
The length of the signature (a, b) = 2 x 160 bits