DOCSLIB.ORG

Re-Visiting HAIFA and Why You Should Visit Too

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Re-Visiting HAIFA and Why You Should Visit Too Merkle-Damg˚ard HAIFA New Results Summary Re-Visiting HAIFA and why you should visit too Orr Dunkelman D´epartement d’Informatique Ecole´ Normale sup´erieure and France Telecom Chaire 3rd of June 2008 Joint work with Eli Biham, Charles Bouillaguet, Pierre-Alain Fouque, S´ebastian Zimmer. Orr Dunkelman Re-Visiting HAIFA and why you should visit too 1/ 42 Merkle-Damg˚ard HAIFA New Results Summary Outline 1 Iterative Hashing — The Merkle Damg˚ard Construction The Merkle-Damg˚ard Construction Generic Attacks on the Merkle-Damg˚ard Construction Possible Conclusions 2 HAsh Iterative FrAmework The HAIFA Construction Dealing with Fix-Points Variable Hash Size Salts 3 New Results on HAIFA Implementing Other Suggested Modes in HAIFA On the Security of HAIFA 4 Summary Orr Dunkelman Re-Visiting HAIFA and why you should visit too 2/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Outline 1 Iterative Hashing — The Merkle Damg˚ard Construction The Merkle-Damg˚ard Construction Generic Attacks on the Merkle-Damg˚ard Construction Possible Conclusions 2 HAsh Iterative FrAmework The HAIFA Construction Dealing with Fix-Points Variable Hash Size Salts 3 New Results on HAIFA Implementing Other Suggested Modes in HAIFA On the Security of HAIFA 4 Summary Orr Dunkelman Re-Visiting HAIFA and why you should visit too 3/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions The Merkle-Damg˚ard Construction ◮ Presented by Merkle and Damg˚ard independently as an answer to the following problem: ◮ Given a compression function f : {0, 1}mc × {0, 1}n → {0, 1}mc , how would you ∗ m generate a hash function Hf : {0, 1} → {0, 1} . Orr Dunkelman Re-Visiting HAIFA and why you should visit too 4/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions The Merkle-Damg˚ard Construction ◮ Presented by Merkle and Damg˚ard independently as an answer to the following problem: ◮ Given a compression function f : {0, 1}mc × {0, 1}n → {0, 1}mc , how would you ∗ m generate a hash function Hf : {0, 1} → {0, 1} . ◮ The solution is as follows: 1 Pad the message M to a multiple of b (with 1, and many 0’s as needed and the length of the message). 2 Divided the padded message into l blocks m1m2 . ml . 3 Set h0 = IV . 4 For i =1 to l, do hi = f (hi−1, mi ). 5 Output hl (or some function of it). Orr Dunkelman Re-Visiting HAIFA and why you should visit too 4/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions The Security of the Merkle-Damg˚ard Construction ◮ Finding a collision in Hf means finding a collision in f . ◮ Thus, if f is collision-resistant, so is Hf . Orr Dunkelman Re-Visiting HAIFA and why you should visit too 5/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions The Security of the Merkle-Damg˚ard Construction ◮ Finding a collision in Hf means finding a collision in f . ◮ Thus, if f is collision-resistant, so is Hf . ◮ Also, finding a second preimage in Hf means finding collision in f . Orr Dunkelman Re-Visiting HAIFA and why you should visit too 5/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions The Security of the Merkle-Damg˚ard Construction ◮ Finding a collision in Hf means finding a collision in f . ◮ Thus, if f is collision-resistant, so is Hf . ◮ Also, finding a second preimage in Hf means finding collision in f . ◮ The same is true for finding a preimage (because you can use it to find a second preimage). Orr Dunkelman Re-Visiting HAIFA and why you should visit too 5/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions The Security of the Merkle-Damg˚ard Construction ◮ Finding a collision in Hf means finding a collision in f . ◮ Thus, if f is collision-resistant, so is Hf . ◮ Also, finding a second preimage in Hf means finding collision in f . ◮ The same is true for finding a preimage (because you can use it to find a second preimage). To conclude, if f is collision resistant (i.e., it takes O(2mc /2) invocations to find a collision), then Hf is collision resistant and (second) preimage resistant with security level of O(2mc /2). Orr Dunkelman Re-Visiting HAIFA and why you should visit too 5/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Attacks against the Merkle-Damg˚ard Construction Let m be the hash size, and mc be the chaining value size. Let l be the number of blocks of a given message M, and let k be the number of given messages (for one-of-many attacks). ◮ Easily invertible compression functions (the backward attack) — 2mc /2 (late 1970’s) ◮ One-of-many preimage attacks, one-of-many second preimage attacks — 2m−k , 2m/2 (Merkle 1979) Orr Dunkelman Re-Visiting HAIFA and why you should visit too 6/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) ◮ Multi-collision — O(2mc /2) (Joux, 2004) 1 1 1 1 m1 m2 m3 m4 h0 h1 h2 h3 h4 2 2 2 2 m1 m2 m3 m4 Finding 2t collisions takes O(t · 2mc /2) (ideally we would t − 2 1 ·m expect O(2 2t c )). Orr Dunkelman Re-Visiting HAIFA and why you should visit too 7/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) ◮ Fixpoint and second preimage attacks (long messages) — − 2mc l , O(2mc /2) (Dean, 1999) [mainly for Davies-Meyer functions] ◮ Find O(2mc /2) fix-points denoted by h A =(h, m). i ◮ Select O(2mc /2) single blocks and compute m B =(CMD (IV , m˜ ), m˜ ). i E ◮ Find a collision between A and B. ◮ Voil`a— an expandable message m˜ ||mt for all t lead to the same chaining value h. hi+1 Orr Dunkelman Re-Visiting HAIFA and why you should visit too 8/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) ◮ Fixpoint and second preimage attacks (long messages) — − 2mc l , O(2mc /2) (Dean, 1999) [mainly for Davies-Meyer functions] ◮ Find O(2mc /2) fix-points denoted by A =(h, m). ◮ Select O(2mc /2) single blocks and compute B =(CMD (IV , m˜ ), m˜ ). E ◮ Find a collision between A and B. 0 ◮ Voil`a— an expandable message m˜ ||mt for all t lead to the same chaining value h. Orr Dunkelman Re-Visiting HAIFA and why you should visit too 8/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) ◮ Fixpoint and second preimage attacks (long messages) — − 2mc l , O(2mc /2) (Dean, 1999) [mainly for Davies-Meyer functions] ◮ Find O(2mc /2) fix-points denoted by A =(h, m). ◮ Select O(2mc /2) single blocks and compute m B =(CMD (IV , m˜ ), m˜ ). i E Pick at ◮ Find a collision between A and B. Random 0 ◮ Voil`a— an expandable message m˜ ||mt for all t lead to the same chaining value h. Orr Dunkelman Re-Visiting HAIFA and why you should visit too 8/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) ◮ Fixpoint and second preimage attacks (long messages) — − 2mc l , O(2mc /2) (Dean, 1999) [mainly for Davies-Meyer functions] ◮ Find O(2mc /2) fix-points denoted by h A =(h, m). i ◮ Select O(2mc /2) single blocks and compute m B =(CMD (IV , m˜ ), m˜ ). i E Pick at ◮ Find a collision between A and B. Random 0 ◮ Voil`a— an expandable message m˜ ||mt for all t lead to the same chaining value h. Orr Dunkelman Re-Visiting HAIFA and why you should visit too 8/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) ◮ Fixpoint and second preimage attacks (long messages) — − 2mc l , O(2mc /2) (Dean, 1999) [mainly for Davies-Meyer functions] ◮ Find O(2mc /2) fix-points denoted by h A =(h, m). i ◮ Select O(2mc /2) single blocks and compute m B =(CMD (IV , m˜ ), m˜ ). i E Pick at ◮ Find a collision between A and B. Random 0 ◮ Voil`a— an expandable message m˜ ||mt for all t lead to the same chaining value h. hi+1 = hi Orr Dunkelman Re-Visiting HAIFA and why you should visit too 8/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) ◮ Fixpoint and second preimage attacks (long messages) — − 2mc l , O(2mc /2) (Dean, 1999) [mainly for Davies-Meyer functions] ◮ Take the message M. hi ◮ Starting from h, try to find a message block x f h x h m s.t., ( , )= i , for one of the chaining i E values of M. ◮ If succeeded, pad the message to the right length and obtain a second preimage. hi+1 = hi Orr Dunkelman Re-Visiting HAIFA and why you should visit too 9/ 42 Merkle-Damg˚ard HAIFA New Results Summary MD Generic Attacks Conclusions Generic Attacks against MD Construction (cont.) − ◮ One-of-many second preimage attacks — 2mc kl , O(2mc /2) (Dean, 1999) ◮ Expandable messages and second preimage attacks (long − messages) — 2mc l , O(2mc /2) (Kelsey, Schneier, 2005) [any iterative hash function]. They forgot to mention, applicable also to one-of-many second preimage attacks − — 2mc kl , O(2mc /2) ◮ In [KS05] the expandable message is constructed as a multi-collision.
Load more

Recommended publications
  • NISTIR 7620 Status Report on the First Round of the SHA-3
    NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2009 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Deputy Director NISTIR 7620: Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Abstract The National Institute of Standards and Technology is in the process of selecting a new cryptographic hash algorithm through a public competition. The new hash algorithm will be referred to as “SHA-3” and will complement the SHA-2 hash algorithms currently specified in FIPS 180-3, Secure Hash Standard. In October, 2008, 64 candidate algorithms were submitted to NIST for consideration. Among these, 51 met the minimum acceptance criteria and were accepted as First-Round Candidates on Dec. 10, 2008, marking the beginning of the First Round of the SHA-3 cryptographic hash algorithm competition. This report describes the evaluation criteria and selection process, based on public feedback and internal review of the first-round candidates, and summarizes the 14 candidate algorithms announced on July 24, 2009 for moving forward to the second round of the competition. The 14 Second-Round Candidates are BLAKE, BLUE MIDNIGHT WISH, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein.
    [Show full text]
  • Preimage Attacks on Reduced-Round GOST and Grøstl-256 and Studies on Several Truncation Patterns for AES-Like Compression Functions (Full Version)?
    Improved (Pseudo) Preimage Attacks on Reduced-Round GOST and Grøstl-256 and Studies on Several Truncation Patterns for AES-like Compression Functions (Full Version)? Bingke Ma1;2;3, Bao Li1;2, Ronglin Hao1;2;4, and Xiaoqian Li1;2;3 1State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100093, China 2Data Assurance and Communication Security Research Center, Chinese Academy of Sciences, Beijing, 100093, China fbkma,lb,[email protected] 3University of Chinese Academy of Sciences, Beijing, China 4Department of Electronic Engineering and Information Science, University of Science and Technology of China, Hefei, 230027, China [email protected] Abstract. In this paper, we present improved preimage attacks on the reduced-round GOST hash function family, which serves as the new Russian hash standard, with the aid of techniques such as the rebound attack, the Meet-in-the-Middle preimage attack and the multicollisions. Firstly, the preimage attack on 5-round GOST-256 is proposed which is the first preimage attack for GOST-256 at the hash function level. Then we extend the (previous) attacks on 5-round GOST-256 and 6-round GOST-512 to 6.5 and 7.5 rounds respectively by exploiting the involution property of the GOST transposition operation. Secondly, inspired by the preimage attack on GOST-256, we also study the impacts of four representa- tive truncation patterns on the resistance of the Meet-in-the-Middle preimage attack against AES-like compression functions, and propose two stronger truncation patterns which make it more difficult to launch this type of attack.
    [Show full text]
  • Attacks on and Advances in Secure Hash Algorithms
    IAENG International Journal of Computer Science, 43:3, IJCS_43_3_08 ______________________________________________________________________________________ Attacks on and Advances in Secure Hash Algorithms Neha Kishore, Member IAENG, and Bhanu Kapoor service but is a collection of various services. These services Abstract— In today’s information-based society, encryption include: authentication, access control, data confidentiality, along with the techniques for authentication and integrity are non-repudiation, and data integrity[1]. A system has to key to the security of information. Cryptographic hashing ensure one or more of these depending upon the security algorithms, such as the Secure Hashing Algorithms (SHA), are an integral part of the solution to the information security requirements for a particular system. For example, in problem. This paper presents the state of art hashing addition to the encryption of the data, we may also need algorithms including the security challenges for these hashing authentication and data integrity checks for most of the algorithms. It also covers the latest research on parallel situations in the dynamic context [2]. The development of implementations of these cryptographic algorithms. We present cryptographic hashing algorithms, to ensure authentication an analysis of serial and parallel implementations of these and data integrity services as part of ensuring information algorithms, both in hardware and in software, including an analysis of the performance and the level of protection offered security, has been an active area of research. against attacks on the algorithms. For ensuring data integrity, SHA-1[1] and MD5[1] are the most common hashing algorithms being used in various Index Terms—Cryptographic Hash Function, Parallel types of applications.
    [Show full text]
  • Improved Generic Attacks Against Hash-Based Macs and HAIFA⋆
    Improved Generic Attacks Against Hash-based MACs and HAIFA? Itai Dinur1 and Ga¨etanLeurent2 1 D´epartement d'Informatique, Ecole´ Normale Sup´erieure,Paris, France [email protected] 2 Inria, EPI SECRET, France [email protected] Abstract. The security of HMAC (and more general hash-based MACs) against state-recovery and universal forgery attacks was very recently shown to be suboptimal, following a series of surprising results by Leurent et al. and Peyrin et al.. These results have shown that such powerful attacks require much less than 2` computations, contradicting the common belief (where ` denotes the internal state size). In this work, we revisit and extend these results, with a focus on properties of concrete hash functions such as a limited message length, and special iteration modes. We begin by devising the first state-recovery attack on HMAC with a HAIFA hash function (using a block counter in every compression function call), with complexity 24`=5. Then, we describe improved trade- offs between the message length and the complexity of a state-recovery attack on HMAC. Consequently, we obtain improved attacks on several HMAC constructions used in practice, in which the hash functions limit the maximal message length (e.g., SHA-1 and SHA-2). Finally, we present the first universal forgery attacks, which can be applied with short message queries to the MAC oracle. In particular, we devise the first universal forgery attacks applicable to SHA-1 and SHA-2. Keywords: Hash functions, MAC, HMAC, Merkle-Damg˚ard,HAIFA, state-recovery attack, universal forgery attack, GOST, Streebog, SHA family.
    [Show full text]
  • A Framework for Iterative Hash Functions — HAIFA*
    A Framework for Iterative Hash Functions — HAIFA? Eli Biham1?? Orr Dunkelman2??? 1 Computer Science Department, Technion. Haifa 32000, Israel [email protected] 2 Katholieke Universiteit Leuven Department of Electrical Engineering ESAT/SCD-COSIC Kasteelpark Arenberg 10, B-3001 Leuven-Heverlee, Belgium [email protected] Abstract. Since the seminal works of Merkle and Damg˚ard on the iter- ation of compression functions, hash functions were built from compres- sion functions using the Merkle-Damg˚ardconstruction. Recently, several flaws in this construction were identified, allowing for second pre-image attacks and chosen target pre-image attacks on such hash functions even when the underlying compression functions are secure. In this paper we propose the HAsh Iterative FrAmework (HAIFA). Our framework can fix many of the flaws while supporting several additional properties such as defining families of hash functions and supporting variable hash size. HAIFA allows for an online computation of the hash function in one pass with a fixed amount of memory independently of the size of the message. Besides our proposal, the recent attacks initiated research on the way compression functions are to be iterated. We show that most recent pro- posals such as randomized hashing, the enveloped Merkle-Damg˚ard,and the RMC and ROX modes can be all be instantiated as part of the HAsh Iterative FrAmework (HAIFA). Keywords: Merkle-Damg˚ard,randomized hashing, Enveloped Merkle- Damg˚ard,RMC, ROX, Wide pipe, HAIFA 1 Introduction Cryptographic hash functions play an increasingly important role in cryptogra- phy. Many primitives and protocols rely on the existence of secure cryptographic ? An initial version of this work was presented in the hash function workshop in Krakow, June 2005 and in the second NIST hash function workshop 2006 in Santa Barbara, August 2006.
    [Show full text]
  • State of the Hash: SHA-3 and Beyond
    State of the hash: SHA-3 and beyond Jean-Philippe Aumasson 1 / 50 Agenda I Background material I NIST’s SHA-3 competition I The SHA-3 candidate BLAKE I Updated cryptanalysis of Skein I On lightweight hashing (QUARK) I Conclusions 2 / 50 What is a crypto hash? HASH, x. There is no definition for this word—nobody knows what hash is. Ambrose Bierce, The Devil’s Dictionary Arbitrary long string −!H Short random-looking string a.k.a. I Modification detection codes I Message authentication codes (when keyed) I Cryptographers’ Swiss Army Knives 3 / 50 Applications of hash functions Generation of secure keys H(physical entropy) Key derivation H(salt, password) Digital signatures SignH(salt, message) MAC’s H(key, message) 4 / 50 Applications of hash functions Passwords storage H(salt, password) Forensics, e.g., proofs of non-modification H(key, evidence) Random oracles in protocols, e.g. challenge-response H(key, random challenge) Construction of pseudorandom generators H(key,nonce,1); H(key,nonce,2);::: 5 / 50 ) we need good hash algorithms! Difficult to define “goodness”: I Many different security requirements, sometimes difficult to formalize and weigh I Many performance metrics and platforms (HW vs SW; speed vs. space, etc.) Hash functions in standards: DSS, PKCS #1, NIST SP 800-108 (HMAC), -56a (key derivation), -106 (randomized hashing), etc. Hash functions are ubiquitous and thus difficult to replace (≈850 uses of MD5 in Windows [Ferguson, 2006]) Currently deployed hashes suffer weaknesses 6 / 50 Hash functions in standards: DSS, PKCS #1, NIST SP 800-108 (HMAC), -56a (key derivation), -106 (randomized hashing), etc.
    [Show full text]
  • Design and Analysis of Hash Functions
    1 DESIGN AND ANALYSIS OF HASH FUNCTIONS A THESIS SUBMITTED TO THE GRADUATE SCHOOL OF APPLIED MATHEMATICS OF MIDDLE EAST TECHNICAL UNIVERSITY BY ONUR KOC¸AK IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF MASTER OF SCIENCE IN CRYPTOGRAPHY JULY 2009 Approval of the thesis: DESIGN AND ANALYSIS OF HASH FUNCTIONS submitted by ONUR KOC¸AK in partial fulfillment of the requirements for the degree of Master of Science in Department of Cryptography, Middle East Technical University by, Prof. Dr. Ersan AKYILDIZ Director, Graduate School of Applied Mathematics Prof. Dr. Ferruh OZBUDAK¨ Head of Department, Cryptography Assoc. Prof. Dr. Ali DOGANAKSOY˘ Supervisor, Department of Mathematics Examining Committee Members: Prof. Dr. Ersan AKYILDIZ Department of Mathematics, METU Assoc. Prof. Dr. Ali DOGANAKSOY˘ Department of Mathematics, METU Dr. Muhiddin UGUZ˘ Department of Mathematics, METU Dr. Meltem Sonmez¨ TURAN Dr. Nurdan SARAN Department of Computer Engineering, C¸ankaya University Date: I hereby declare that all information in this document has been obtained and presented in accordance with academic rules and ethical conduct. I also declare that, as required by these rules and conduct, I have fully cited and referenced all material and results that are not original to this work. Name, Last Name: ONUR KOC¸AK Signature : iii ABSTRACT DESIGN AND ANALYSIS OF HASH FUNCTIONS KOC¸AK, Onur M.S, Department of Cryptography Supervisor : Assoc. Prof. Dr. Ali DOGANAKSOY˘ July 2009, 63 pages Hash functions are cryptographic tools that are used in various applications like digital sig- nature, message integrity checking, password storage and random number generation. These cryptographic primitives were, first, constructed using modular arithmetical operations which were popular at that time because of public key cryptography.
    [Show full text]
  • Downloaded on 2017-02-12T10:18:32Z Cryptographic Coprocessors for Embedded Systems
    Title Cryptographic coprocessors for embedded systems Author(s) Hamilton, Mark Publication date 2014 Original citation Hamilton, M. 2014. Cryptographic coprocessors for embedded systems. PhD Thesis, University College Cork. Type of publication Doctoral thesis Rights © 2014, Mark Hamilton http://creativecommons.org/licenses/by-nc-nd/3.0/ Embargo information No embargo required Item downloaded http://hdl.handle.net/10468/1770 from Downloaded on 2017-02-12T10:18:32Z Cryptographic Coprocessors for Embedded Systems Mark Hamilton Department of Electrical and Electronic Engineering National University of Ireland, Cork Research Supervisor : Dr. William P. Marnane Head of Department : Prof. Nabeel Riza A thesis submitted for the degree of Doctor of Philosophy January 24, 2014 Abstract In the field of embedded systems design, coprocessors play an important role as a component to increase performance. Many embedded systems are built around a small General Purpose Processor (GPP). If the GPP cannot meet the performance requirements for a certain operation, a coprocessor can be included in the design. The GPP can then offload the computationally in- tensive operation to the coprocessor; thus increasing the performance of the overall system. A common application of coprocessors is the acceleration of cryptographic algorithms. The work presented in this thesis discusses co- processor architectures for various cryptographic algorithms that are found in many cryptographic protocols. Their performance is then analysed on a Field Programmable Gate Array (FPGA) platform. Firstly, the acceleration of Elliptic Curve Cryptography (ECC) algorithms is investigated through the use of instruction set extension of a GPP. The performance of these algorithms in a full hardware implementation is then investigated, and an architecture for the acceleration the ECC based digital signature algorithm is developed.
    [Show full text]
  • Construction Methods on Cryptographic Hash Functions * C
    Volume : 2 | Issue : 4 | April 2013 ISSN - 2250-1991 Research Paper Mathematics Construction Methods on Cryptographic Hash Functions * C. Krishna Kumar ** Dr. C. Suyambulingom * Sathyabama University, Chennai, India ** Professor, Dept. of Mathematics, TAU, Coimbatore, India ABSTRACT The design of hash functions are investigated under two subtopics which are compression functions and the construction methods. Compression functions are the core of the hashing algorithms and most of the effort is on the compression function when designing an algorithm. Moreover, for Merkle-Damgard hash functions, the security of the algorithm depends on the security of the compression function. Construction method is also na important design parameter which defines the strength of the algorithm. Construction method and compression function should be consistent Keywords : metrics, software, quality, estimation 1.Construction Methods construction methods of hash functions are discussed in de- tails. Iterative hash functions still pace a big portion of all hash constructions. Therefore, iterative designs will be investigated deeply.These constructions include Merkle-Damgard(MD)1, HAIFA and some other alternative designs derived from Merkle-Damgard. Besides, sponge constructions is included. Figure 1.1: MD Structure Sponge construction is a new and secure construction meth- od which is becoming more popular. The iterative structure of MD construction enables arbitrary length messages to be processed easily by the hash func- 1.1 Merkle-Damgård Construction tions. Also padding the message length and using a non-zero Merkle-Damgard construction is the most widely used hash IV, which is called is called the MD − strengthening, increases construction method, which was designed by R.Merkle [50] the defeats or increases the complexity of various attacks.
    [Show full text]
  • Design and Analysis of Hash Functions
    DESIGN AND ANALYSIS OF HASH FUNCTIONS By Murali Krishna Reddy Danda Under the supervision of: Principle Supervisor : Dr. Xun Yi Co-supervisor : Dr. Alasdair McAndrew For the degree of Master of Science by Research (Computer Science) (Two years Masters by Research thesis in Network security and Cryptography/ Internet Security) A thesis submitted to the School of Computer Science and Mathematics, Victoria University 2007 i Declaration “I, Murali Krishna Reddy Danda, declare that the Master by Research thesis entitled Design and Analysis of Hash Functions is no more than 60,000 words in length, exclusive of tables, figures, appendices, references and footnotes. This thesis contains no material that has been submitted previously, in whole or in part, for the award of any other academic degree or diploma. Except where otherwise indicated, this thesis is my own work”. Signature Date ii Acknowledgments It is first a privilege and a pleasure for me to thank my principle supervisor, Senior Lecturer Dr. Xun Yi and my co-supervisor, Senior Lecturer Dr. Alasdair McAndrew, for their constant encouragement, support and advice. Without their enthusiasm (and well-timed prods), their never failing humour and their assurances at all times that my research was worth while, this thesis would barely have begun, much less been completed. I greatly acknowledge Associate Professor Peter Cerone, Head of School of Computer Science and Mathematics and other staff of the school of Computer Science and Mathematics for being supportive and cooperative. I deeply owe my appreciation to my research office mates Michael Grubinger, Hao Lan Zhang and Guandong Xu for their friendly and frank advice.
    [Show full text]
  • Merkle-Damgård Construction Method and Alternatives: a Review
    JIOS, VOL. 41, NO. 2 (2017) SUBMITTED 10/16; ACCEPTED 09/17 UDC 004.056.55 Survey Paper Merkle-Damgård Construction Method and Alternatives: A Review Harshvardhan Tiwari [email protected] Centre for Incubation, Innovation, Research and Consultancy (CIIRC) Jyothy Institute of Technology, Bangalore, Karnataka, India Abstract Cryptographic hash function is an important cryptographic tool in the field of information security. Design of most widely used hash functions such as MD5 and SHA-1 is based on the iterations of compression function by Merkle-Damgård construction method with constant initialization vector. Merkle-Damgård construction showed that the security of hash function depends on the security of the compression function. Several attacks on Merkle-Damgård construction based hash functions motivated researchers to propose different cryptographic constructions to enhance the security of hash functions against the differential and generic attacks. Cryptographic community had been looking for replacements for these weak hash functions and they have proposed new hash functions based on different variants of Merkle-Damgård construction. As a result of an open competition NIST announced Keccak as a SHA-3 standard. This paper provides a review of cryptographic hash function, its security requirements and different design methods of compression function. Keywords: Cryptographic hash function, Information security, Merkle-Damgård construction, MD5, SHA-1, Differential attacks, Generic attacks. 1. Introduction Cryptographic hash function is a one-way and compression function that converts an arbitrary length message to a fixed length hash value. This hash value of a message is also known as the fingerprint of the message. Any small change or modification in the input data causes the drastic change in the hash value.
    [Show full text]
  • The Shavite-3 Hash Function Tweaked Version
    The SHAvite-3 Hash Function Tweaked Version Eli Biham1,⋆ and Orr Dunkelman2,⋆⋆ 1 Computer Science Department, Technion Haifa 32000, Israel [email protected] 2 Ecole´ Normale Sup´erieure D´epartement d’Informatique, CNRS, INRIA 45 rue d’Ulm, 75230 Paris, France [email protected] Abstract. In this document we present SHAvite-3, a secure and efficient hash function based on the HAIFA construction and the AES building blocks. SHAvite-3 uses a well understood set of primitives such as a Feistel block cipher which iterates a round function based on the AES round function. SHAvite-3’s compression functions are secure against cryptanalysis, while the selected mode of iteration offers maximal security against black box attacks on the hash function. SHAvite-3 is both fast and resource-efficient, making it suitable for a wide range of environments, ranging from 8-bit platforms to 64-bit platforms (and beyond). 1 Introduction The recent security findings on the (lack of) collision resistance in SHA-1 [30, 70] mark the close end of SHA-1’s useful life. Although the use of SHA-256 may be a solution for this specific issue, the recent collision finding techniques as well as the results on the second preimage resistance of Merkle-Damg˚ard hash functions and the similarity of the SHA-256 design to the design of SHA-1, motivated the US National Institutes of Standards and Technology to issue a call for a successor algorithm to be named SHA-3. The essential requirements for SHA-3 are the support for message digests of 224, 256, 384, and 512 bits.
    [Show full text]