1. Hash Functions Motivation Hash Functions: collision, pre-images SHA-1
CSCI284 Spring 2009
GWU

2. The problems crypto addresses
Confidentiality/secrecy/privacy
How to keep a message secret so it can be read only by a chosen person
Use encryption
Integrity
How to determine a string of symbols has not been changed since it was created ?
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

3. CS284/Spring09/GWU/Vora/Hash Functions
Integrity
Alice sends message x to Bob. She fears Oscar will manipulate it along the way, and Bob will get an incorrect message.
She could encrypt it using a key Oscar did not have, but is that overkill when she does not need to prevent Oscar from reading it?
But maybe she could tell Bob something else about the message so he would know if something was terribly wrong: parity, last bit, a particular bit, etc.
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

4. In general, she could use a hash function
h: X  Y
y = h(x)
|X| > |Y|
i.e.  x, x’ s.t x  x’ and h(x) = h(x’)
Used in storage tables
E.g.: h(x) = last bit, parity, smallest prime factor
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

5. CS284/Spring09/GWU/Vora/Hash Functions
h(x) sent with x
Both Bob and Alice can create h(x) given x
Alice sends (x, h(x))
Bob receives (x’,y’), he checks if y’ = h(x’).
If so, he assumes x’ is what Alice sent
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

6. In either case, what can the attacker do?
If he can compute h(x), he can:
try to find x’ s.t. h(x) = h(x’).
If he knows h, and can influence Alice, he can
try to get her to send an x that she likes such that h(x) = h(x’) for an x’ he likes.
If he doesn’t, he hopes for the best.
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

7. Hence require an h “secure” in the following ways:
Secure wrt second image requires that the following problem is “difficult”:
Given an xX, find x’ X s.t x’  x but h(x’) = h(x)
Secure wrt collision requires that the following problem is “difficult”:
Find x, x’ X s.t x’  x but h(x’) = h(x)
The above should be true even if h(x1), h(x2).. h(xn) are known
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

8. In general, h is a secure-hash
It is also a one-way function: easy to compute in one direction, hard in the other.
Is the following h secure wrt second image and collision?
h: Zn X Zn  Zn
h(x, y) = ax + by mod n
h(x, y) = ax2 + by2 mod n
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

9. CS284/Spring09/GWU/Vora/Hash Functions
Easy?
How does one define easy/difficult to compute?
Using computational complexity theory
By requiring a large time for the computation on any computer given a particular computational model
For example, the probabilistic polynomial-time model
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

10. Algorithm Find Pre-Image(h, y, q)
choose any X0  X, | X0 | = q
for each x  X0
if h(x) = y
return (x)
endfor
return(failure)
What is the complexity of this algorithm?
What is its probability of success?
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

11. Algorithm Find Second Pre-Image(h, x, q)
y  h(x)
choose any X0  X\{x}, | X0 | = q-1
for each x0  X0
if h(x0) = y
return (x0)
endfor
return(failure)
What is the complexity of this algorithm?
What is its probability of success?
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

12. Algorithm Find Collision (h, q)
choose any X0  X, | X0 | = q
for each x  X0
yx  h(x)
endfor
for all pairs (x, x’)
if yx = yx’
return (x, x’)
return(failure)
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

13. Probability of success
For a lower bound, can assume that sizes of pre-images are about equal, so that one pre-image is not very large - if it were, it would be very easy to have a collision in that pre-image.
M = |Y|
probability of no collisions = q-1i=1(1 - i/M)
probability of at least one collision:
(using e-x/M  1 -x/M)
1 - q-1i=1(1 - i/M)  1 - e-q(q-1)/2M
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

14. CS284/Spring09/GWU/Vora/Hash Functions
Allowed n, q
For a given acceptable collision probability p, what is q in terms of M and p?
p = 1 - q-1i=1(1 - i/M)  1 - e-q(q-1)/2M
q  (2M ln(1/1-p))
For p = 0.5, q  1.17M
if M = 365, q  23 and the probability of 2 people having the same birthday in a group of 23 people is more than 0.5 – Birthday attack/paradox
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

15. Complexities/Probability of success
Find Pre-Image
Success Probability: 1-(1-1/M)q  q/M
Complexity: (q)
Find Second Pre-Image
Success Probability: 1-(1-1/M)q-1  q/M
Find Collision
Success Probability: 1 - q-1i=1(1 - i/M)  1 - e-q(q-1)/2M
Complexity: (q2)
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

16. CS284/Spring09/GWU/Vora/Hash Functions
SHA-1
Pad given string x so that it is of length a multiple of 512 bits. Call this string y = M1||M2||…||Mn
Iteratively calculate the hash of y using a hash function (known as the compression function) for 512 bits (hash is of length 160 bits)
What is complexity of a birthday attack?
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions

17. CS284/Spring09/GWU/Vora/Hash Functions
SHA-1 contd.
current_hash = H0||H1||H2||H3||H4
for i=1, 2, ..n
A||B||C||D||E|| = h(Mi, current_hash)
H0+=A; H1+=B; …
endfor
2/24/2019
CS284/Spring09/GWU/Vora/Hash Functions