Performance of Message Authentication Codes for Secure Ethernet Philipp Hagenlocher Advisors: Dominik Scholz & Fabien Geyer Seminar Future Internet SS2018 Chair of Network Architectures and Services Departments of Informatics, Technical University of Munich Email: [email protected] ABSTRACT connection establishment in order to waste resources on the Cyclic redundancy checks within Ethernet do not provide server until a denial of service is reached. To combat this data integrity, which can be solved by using message au- attack scheme, a hash function is used to compute a hash thentication codes (MACs) within Ethernet frames. This combining the IP address of the client, port numbers and a paper gives theoretical background on hash functions and timestamp. This hash is then used as the sequence number hash-based MACs, different schemes are compared for the for the packet. This way the client is identified by this hash, usage in Ethernet frames by multiple attributes such as thus the server can free old resources if a new SYN is sent by performance, output lengths and security. The functions the client. Another important usage for hash functions are Poly1305, Skein and BLAKE2 are tested for throughput lookup tables, where hash functions are used to group val- against implementations of a SHA-2 HMAC and SipHash ues into segments that can be retrieved in faster time than and the results are discussed. Numerical measurements and a simple lookup in a set of elements. results show that Poly1305 is a suitable candidate for the usage as a per-packet MAC. 1.1 Outline This paper is structured as follows: At first it will explain Keywords the theory behind hash functions and hash-based MACs in Message Authentication Codes, Hash functions, Performance Section 2. Section 3 will give an overview over possible can- evaluation, Secure Ethernet didates for the usage as a MAC scheme within Ethernet and Section 4 will explain the testing environment and discuss 1. INTRODUCTION test results. The conclusion to the test results and further In daily communication within LANs, MANs and WANs, discussion is given in Section 5. computers use the Ethernet protocol and furthermore send so called Ethernet frames over the network in order to com- 2. HASH FUNCTIONS municate. These frames possess a checksum calculated with A hash function h is defined as a one-way function a cyclic redundancy check (CRC), which is a code to detect n errors, in the form of flipped bits, within the frame [27]. h :Σ∗ Σ → This ensures that transmission errors are detected. where Σ = 0, 1 ,Σn denotes all bitstrings of length n and { } Σ∗ denotes all bitstrings of arbitrary length [6, p. 177]. In Using CRC has the advantage of needing only a small amount order for this function to be cryptographically secure the of space (32 bits) and having a code that can be computed function needs to have weak and strong collision resistance. in short time. The problem with CRC is that it does not Weak collision resistance is defined as the absence of an effi- indicate data integrity of the frame if an attacker tries to cient algorithm that, for a given m, can find a m0 such that maliciously alter it. The attacker can easily recompute the h(m) = h(m0). Strong collision resistance is defined as the CRC since there is no secret protecting the checksum [31]. absence of an efficient algorithm that can find any m and m0 such that h(m) = h(m0). These properties are impor- In order to combat the problem of data integrity message tant for the use of these hash functions in a MAC scheme authentication codes (MAC) are often used in cryptographic since we don’t want an attacker to be able to guess what protocols. MACs based on cryptographic hash functions possible alterations can be made to the content of the mes- can use an additional secret key in order to combine the sage or, even worse, find out what the shared secret key is. integrity of the frame with a shared secret, thus blocking a Hash functions that possess these properties are known as potential attacker from altering the frame and computing cryptographic hash functions. a correct checksum. A popular usage of hash functions in MACs are hash-based message authentication codes defined in Section 2.3, although MACs do not have to be constructed 2.1 Security of hash functions with or from hash functions. Another application of hash When talking about cryptographic strength of a hash func- functions are TCP SYN cookies, which are used in order to tion, what is really talked about is the computational com- combat TCP SYN flooding attacks [28], where an attacker plexity of finding a collision. Let h be a perfect hash func- intentionally doesn’t complete the 3-way-handshake of TCP tion with perfect weak and strong collision resistance and Seminars FI / IITM SS 18, 27 doi: 10.2313/NET-2018-11-1_04 Network Architectures and Services, September 2018 an output length of n. In order to find a collision, an at- It is easy to see that it is absolutely possible to switch tacker would need to randomly try out different m and m0 out H with any cryptographic hash function and that a and check if h(m) = h(m0). Since hash functions have a cryptographic hash function is needed in order for the HMAC fixed output length the number of possible hash values is to be secure and that the computational speed of the algo- limited. Due to the birthday paradox [6, p. 175-180] the rithm is heavily influenced by the speed of the underlying complexity of randomly trying out different input values is hash function. n 2 2 . Generally, a hash function is considered unsafe once this complexity can be reduced drastically and thus mak- ing it practically possible to brute-force collisions or even 3. SURVEY compute them outright. This section describes and compares suitable candidates for our use-case. Surveying the finalists of the hash function This example is known as a birthday attack. This attack competition by the US National Institute of Standards and cannot be improved if the hash function has perfect strong Technology (NIST) is a good choice to find hash functions collision resistance. Another attack is the pre-image attack, for an HMAC construction since these functions have been which describes finding an appropriate x to a given y such preselected due to their performance and security. As well that h(x) = y. Brute-forcing this x has the complexity of as the finalists of this competition more MAC schemes will 2n where n is the output length of h. This attack cannot be taken into consideration, that have recently found usage be improved if the hash function has perfect weak or strong in real world applications. collision resistance. Since performance is an important measure to go by it is advantageous for a candidate to be usable as a standalone 2.2 Construction MAC scheme. Otherwise an HMAC has to be created out Constructing hash functions has many strategies. One of the of the function in question, which uses two distinct calls to most popular schemes is the Merkle-Damg˚ard construction the function thus slowing down the resulting MAC scheme. described by Merkle [24, p. 13-15]. This construction splits the message into blocks and applies a function f(k, m) to these blocks: 3.1 Use-case The use case is a per packet message authentication code. f(...f(f(s, b ), b )..., ...b ) 1 2 n Obviously this MAC needs to be secure, but has to have where s denotes a fixed starting value and bn denotes the nth a high performance in order to not slow down traffic too message block. There can be a finalization function applied much, since bandwidths of 10 Gbit/s can be achieved and on the result of this computation. f could be an encryption should not be bottlenecked by the CPU and hash computa- function that takes a key k and a message m. Popular hash tion. Initial tests with an HMAC using SHA-256 and SHA- function families like MD, SHA-1 and SHA-2 all use this 512 showed bad performance, which can be seen in figure 3 kind of construction. and 4. This performance was increased by switching to an 32-bit variant of SipHash (explained in Section 3.3.7). Of course there are many ways of constructing hash func- tions such as using permutation networks, S-Boxes and other parts of block ciphers in order to build a one-way function. 3.2 Unsafe functions JH [15, p. 26], BLAKE [18] and Keccak [17] are examples Several functions will not be taken into consideration since of that. attacks against these functions have been demonstrated or are theoretically possible. These functions are The aforementioned substitution boxes (S-Boxes) are used by many hash functions in their construction. They describe a MD4 [36] GOST [11] mapping from bitstrings of fixed size to other bitstrings of • • another fixed size. For example, the S-Boxes within the MD5 [32] HAVAL-128 [34] • • block cipher DES can be represented as a table of values SHA1 [30] RIPEMD [35] used for substitution, where the choice of columns and rows • • is done by looking at the outer and inner bits of the bitstring that needs to be substituted [6, p. 76-77]. 3.3 Candidates In this section possible candidates for the described use-case 2.3 Hash-Based Message Authentication Code are described and important features are highlighted.