CS/ECE 478 Introduction to Network Security Dr. Attila Altay Yavuz

1. CS/ECE 478 Introduction to Network SecurityDr. Attila Altay Yavuz Cryptographic Hash Functions Credit: Prof. Dr. Peng Ning Dr. Shai Halevi Dr. Attila Altay Yavuz

2. Hash Function Properties Dr. Attila Altay Yavuz

3. Hash Function • Also known as • Message digest • One-way transformation • One-way function • Hash • Length of H(m) much shorter then length of m • Usually fixed lengths: 160 or 256 bits (preferred) Message of arbitrary length A fixed-length short message Hash

4. h M1 M2 ML-1 ML … d2 dL-1 dL d1 IV=d0 d=H(M) h h h h How are they built? But not always… Typically using Merkle-Damgård iteration: • Start from a “compression function” • h: {0,1}b+n{0,1}n • Iterate it |M|=b=512 bits c=160 bits d=h(c,M)=160 bits

5. What are they good for? “Modern, collision resistant hash functions were designed to create small, fixed size message digests so that a digest could act as a proxy for a possibly very large variable length message in a digital signature algorithm, such as RSA or DSA. These hash functions have since been widely used for many other “ancillary” applications, including hash-based message authentication codes, pseudo random number generators, and key derivation functions.” “Request for Candidate Algorithm Nominations”, -- NIST

6. Desirable Properties of Hash Functions • Consider a hash function H • Performance: Easy to compute H(m) • One-way property: Given H(m) but not m, it’s computationally infeasible to find m • Weak collision resistance: Given H(m), it’s computationally infeasible to find m’ such that H(m’) = H(m). • Strong collision resistance: Computationally infeasible to find m1, m2 such that H(m1) = H(m2)

7. Length of Hash Image • Question • Why do we have 160 bits or 256 bits in the output of a hash function? • If it is too long • Unnecessary overhead • If it is too short • Birthday paradox • Loss of strong collision property

8. Birthday Paradox (Cont’d) • Implication for hash function H of length m • With probability at least 0.5 • If we hash about 2m/2 random inputs, • Two messages will have the same hash image • Birthday attack • Conclusion • Choose m  160, preferable m  256

9. Hash Function Use and Applications Dr. Attila Altay Yavuz

10. Using “imperfect” hash functions • Applications should rely only on “specific security properties” of hash functions • Try to make these properties as “standard” and as weak as possible • Increases the odds of long-term security • When weaknesses are found in hash function, application more likely to survive • E.g., MD5 is badly broken, but HMAC-MD5 is barely scratched

11. Security requirements • Deterministic hashing • Attacker chooses M, d=H(M) • Hashing with a random salt • Attacker chooses M, then good guychooses public salt, d=H(salt,M) • Hashing random messages • Given M, d=H(M’) e.g., M’=M||r • Hashing with a secret key • Attacker chooses M, d=H(key,M) Stronger Weaker

12. Deterministic hashing • Collision Resistance • Attacker cannot find M,M’ such that H(M)=H(M’) • Also many other properties • Hard to find fixed-points, near-collisions, M s.t. H(M) has low Hamming weight, etc.

13. Hashing with public salt • Target-Collision-Resistance (TCR) • Attacker chooses M, then given random salt, cannot find M’ such that H(salt,M)=H(salt,M’) • enhanced TRC (eTCR) • Attacker chooses M, then given random salt, cannot find M’,salt’ s.t. H(salt,M)=H(salt’,M’)

14. Hashing random messages • Second Preimage Resistance • Given random M, attacker cannot find M’such that H(M)=H(M’) • One-wayness • Given d=H(M) for random M, attacker cannot find M’ such that H(M’)=d • Extraction • For random salt, high-entropy M, the digest d=H(salt,M) is close to being uniform

15. Hashing with a secret key • Pseudo-Random Functions • The mapping MH(key,M) for secret keylooks random to an attacker

16. Application 1:Digital signatures • Hash-then-sign paradigm • First shorten the message, d = H(M) • Then sign the digest, s = SIGN(d) • Relies on collision resistance • If H(M)=H(M’) then s is a signature on both  Attacks on MD5, SHA-1 threaten current signatures • MD5 attacks can be used to get bad CA cert[Stevens et al. 2009]

17. Verifying a signature Message m H(m) Hash Verify Valid /Not Valid Signature Bob’s Public key Application: DigitalSignatures • Only one party (Bob) knows the private key Generating a signature H(m) Message m Signature (encryptedhash) Hash Sign Bob’s Private key

18. Collision resistance is hard • Attacker works off-line (find M,M’) • Can use state-of-the-art cryptanalysis, as much computation power as it can gather, without being detected !! • Helped by birthday attack (e.g., 280 vs 2160) • Well worth the effort • One collision  forgery for any signer

19. same salt (since salt is explicitly signed) Signatures without CRHF [Naor-Yung 1989, Bellare-Rogaway 1997] • Use randomized hashing • To sign M, first choose fresh random salt • Set d= H(salt, M), s= SIGN( salt || d ) • Attack scenario (collision game): • Attacker chooses M • Signer chooses random salt • Attacker must find M' s.t. H(salt,M) = H(salt,M') • Attack is inherently on-line • Only rely on target collision resistance

20. TCR hashing for signatures • Not every randomization works • H(M|salt) may be subject to collision attacks • when H is Merkle-Damgård • Yet this is what PSS does (and it’s provable in the ROM) • Many constructions “in principle” • From any one-way function • Some engineering challenges • Most constructions use long/variable-size randomness, don’t preserve Merkle-Damgård • Also, signing salt means changing the underlying signature schemes

21. The Hashed Message Authentication Code (HMAC) Attila Altay Yavuz

22. Authentication with HMAC [Bellare-Canetti-Krawczyk 1996] • Simple key-prepend/append have problems when used with a Merkle-Damgård hash • tag=H(key | M) subject to extension attacks • HMAC: Compute tag = H(key || H(key || M)) • About as fast as key-prepend for a MD hash • Relies only on PRF quality of hash • MH(key|M) looks random when key is secret

23. 0x5c5c5c…5c  concatenate computemessage digest HMAC(key,message) HMAC Processing Key K 0x363636…36 pad on right with 0’s to 512 bits in length Message M  concatenate computemessage digest Dr. Peng Ning

24. Is Encryption a Good Hash Function? • Building hash using block chaining techniques • Encryption block size may be too short (DES=64) • Birthday attack • Extension attacks constant M1 M2 M3 M4 E E E E 64 Hash

25. Modern Hash Functions • MD5 • Previous versions (i.e., MD2, MD4) have weaknesses. • Broken; collisions published in August 2004 • Too weak to be used for serious applications • SHA-1 • Broken: Both in theory and with real-attack • Collisions in 269 hash operations, much less than the brute-force attack of 280 operations CRYPTO ’05 • http://thehackernews.com/2017/02/sha1-collision-attack.html • SHA-256, SHA-384, … • BLAKE-256/512 (good for embedded devices)

26. (In)security of MD5 • A few recently discovered methods can find collisions in a few hours • A few collisions were published in 2004 • Can find many collisions for 1024-bit messages • More discoveries afterwards • In 2005, two X.509 certificates with different public keys and the same MD5 hash were constructed • This method is based on differential analysis • 8 hours on a 1.6GHz computer • Much faster than birthday attack

27. Summary • Hashing is fast to compute • Has many applications (some making use of a secret key) • Hash images must be at least 160 bits long • but longer is better  256 is ideal • Hash function details are tedious  • HMAC protects message digests from extension attacks