Key-Recovery Attacks on Universal Hash Function Based MAC Algorithms
Key-Recovery Attacks on Universal Hash Function Based MAC Algorithms Helena Handschuh1 and Bart Preneel2,3 1 Spansion, 105 rue Anatole France 92684 Levallois-Perret Cedex, France helena.handschuh@spansion.com 2 Katholieke Universiteit Leuven, Dept. Electrical Engineering-ESAT/COSIC, Kasteelpark Arenberg 10, bus 2446, B-3001 Leuven, Belgium bart.preneel@esat.kuleuven.be 3 IBBT, Van Crommenlaan, B-9000 Gent Abstract. This paper discusses key recovery and universal forgery at- tacks on several MAC algorithms based on universal hash functions. The attacks use a substantial number of verification queries but eventually allow for universal forgeries instead of existential or multiple forgeries. This means that the security of the algorithms completely collapses once a few forgeries are found. Some of these attacks start off by exploiting a weak key property, but turn out to become full-fledged divide and conquer attacks because of the specific structure of the universal hash functions considered. Partial information on a secret key can be exploited too, in the sense that it renders some key recovery attacks practical as soon as a few key bits are known. These results show that while universal hash functions offer provable security, high speeds and parallelism, their simple combinatorial properties make them less robust than conventional message authentication primitives. 1 Introduction Message Authentication Code (MAC) algorithms are symmetric cryptographic primitives that allow senders and receivers who share a common secret key to make sure the contents of a transmitted message has not been tampered with. Three main types of constructions for MAC algorithms can be found in the literature: constructions based on block ciphers, based on hash functions and based on universal hash functions.
CS 473: Algorithms, Fall 2019 Universal and Perfect Hashing Lecture 10 September 26, 2019 Chandra and Michael (UIUC) cs473 1 Fall 2019 1 / 45 Today's lecture: Review pairwise independence and related constructions (Strongly) Universal hashing Perfect hashing Announcements and Overview Pset 4 released and due on Thursday, October 3 at 10am. Note one day extension over usual deadline. Midterm 1 is on Monday, Oct 7th from 7-9.30pm. More details and conflict exam information will be posted on Piazza. Next pset will be released after the midterm exam. Chandra and Michael (UIUC) cs473 2 Fall 2019 2 / 45 Announcements and Overview Pset 4 released and due on Thursday, October 3 at 10am. Note one day extension over usual deadline. Midterm 1 is on Monday, Oct 7th from 7-9.30pm. More details and conflict exam information will be posted on Piazza. Next pset will be released after the midterm exam. Today's lecture: Review pairwise independence and related constructions (Strongly) Universal hashing Perfect hashing Chandra and Michael (UIUC) cs473 2 Fall 2019 2 / 45 Part I Review Chandra and Michael (UIUC) cs473 3 Fall 2019 3 / 45 Pairwise independent random variables Definition Random variables X1; X2;:::; Xn from a range B are pairwise independent if for all 1 ≤ i < j ≤ n and for all b; b0 2 B, 0 0 Pr[Xi = b; Xj = b ] = Pr[Xi = b] · Pr[Xj = b ] : Chandra and Michael (UIUC) cs473 4 Fall 2019 4 / 45 Interesting case: n = m = p where p is a prime number Pick a; b uniformly at random from f0; 1; 2;:::; p − 1g Set Xi = ai + b Only need to store a; b.
Search Algorithms and Tables Chapter 11 Tables • A table, or dictionary, is an abstract data type whose data items are stored and retrieved according to a key value. • The items are called records. • Each record can have a number of data fields. • The data is ordered based on one of the fields, named the key field. • The record we are searching for has a key value that is called the target. • The table may be implemented using a variety of data structures: array, tree, heap, etc. Sequential Search public static int search(int[] a, int target) { int i = 0; boolean found = false; while ((i < a.length) && ! found) { if (a[i] == target) found = true; else i++; } if (found) return i; else return –1; } Sequential Search on Tables public static int search(someClass[] a, int target) { int i = 0; boolean found = false; while ((i < a.length) && !found){ if (a[i].getKey() == target) found = true; else i++; } if (found) return i; else return –1; } Sequential Search on N elements • Best Case Number of comparisons: 1 = O(1) • Average Case Number of comparisons: (1 + 2 + ... + N)/N = (N+1)/2 = O(N) • Worst Case Number of comparisons: N = O(N) Binary Search • Can be applied to any random-access data structure where the data elements are sorted. • Additional parameters: first – index of the first element to examine size – number of elements to search starting from the first element above Binary Search • Precondition: If size > 0, then the data structure must have size elements starting with the element denoted as the first element. In addition, these elements are sorted.
Introduction hashing performs basic operations, such as insertion, Chapter 5 deletion, and finds in average time Hashing 2 Hashing Hashing Functions a hash table is merely an of some fixed size let be the set of search keys hashing converts into locations in a hash hash functions map into the set of in the table hash table searching on the key becomes something like array lookup ideally, distributes over the slots of the hash table, to minimize collisions hashing is typically a many-to-one map: multiple keys are if we are hashing items, we want the number of items mapped to the same array index hashed to each location to be close to mapping multiple keys to the same position results in a example: Library of Congress Classification System ____________ that must be resolved hash function if we look at the first part of the call numbers two parts to hashing: (e.g., E470, PN1995) a hash function, which transforms keys into array indices collision resolution involves going to the stacks and a collision resolution procedure looking through the books almost all of CS is hashed to QA75 and QA76 (BAD) 3 4 Hashing Functions Hashing Functions suppose we are storing a set of nonnegative integers we can also use the hash function below for floating point given , we can obtain hash values between 0 and 1 with the numbers if we interpret the bits as an ______________ hash function two ways to do this in C, assuming long int and double when is divided by types have the same length fast operation, but we need to be careful when choosing first method uses
Cuckoo Hashing Rasmus Pagh* BRICSy, Department of Computer Science, Aarhus University Ny Munkegade Bldg. 540, DK{8000 A˚rhus C, Denmark. E-mail: pagh@daimi.au.dk and Flemming Friche Rodlerz ON-AIR A/S, Digtervejen 9, 9200 Aalborg SV, Denmark. E-mail: ffr@onair-dk.com We present a simple dictionary with worst case constant lookup time, equal- ing the theoretical performance of the classic dynamic perfect hashing scheme of Dietzfelbinger et al. (Dynamic perfect hashing: Upper and lower bounds. SIAM J. Comput., 23(4):738{761, 1994). The space usage is similar to that of binary search trees, i.e., three words per key on average. Besides being conceptually much simpler than previous dynamic dictionaries with worst case constant lookup time, our data structure is interesting in that it does not use perfect hashing, but rather a variant of open addressing where keys can be moved back in their probe sequences. An implementation inspired by our algorithm, but using weaker hash func- tions, is found to be quite practical. It is competitive with the best known dictionaries having an average case (but no nontrivial worst case) guarantee. Key Words: data structures, dictionaries, information retrieval, searching, hash- ing, experiments * Partially supported by the Future and Emerging Technologies programme of the EU under contract number IST-1999-14186 (ALCOM-FT). This work was initiated while visiting Stanford University. y Basic Research in Computer Science (www.brics.dk), funded by the Danish National Research Foundation. z This work was done while at Aarhus University. 1 2 PAGH AND RODLER 1. INTRODUCTION The dictionary data structure is ubiquitous in computer science.
Double Hashing Intro & Coding Hashing Hashing - provides O(1) time on average for insert, search and delete Hash function - maps a big number or string to a small integer that can be used as index in hash table. Collision - Two keys resulting in same index. Hashing – a Simple Example ● Arbitrary Size à Fix Size 0 1 2 3 4 Hashing – a Simple Example ● Arbitrary Size à Fix Size Insert(0) 0 % 5 = 0 0 1 2 3 4 0 Hashing – a Simple Example ● Arbitrary Size à Fix Size Insert(0) 0 % 5 = 0 Insert(5321) 5321 % 5 = 1 0 1 2 3 4 0 5321 Hashing – a Simple Example ● Arbitrary Size à Fix Size Insert(0) 0 % 5 = 0 Insert(5321) 5321 % 5 = 1 Insert(-8002) -8002 % 5 = 3 0 1 2 3 4 0 5321 -8002 Hashing – a Simple Example ● Arbitrary Size à Fix Size Insert(0) 0 % 5 = 0 Insert(5321) 5321 % 5 = 1 Insert(-8002) -8002 % 5 = 3 Insert(20000) 20000 % 5 = 0 0 1 2 3 4 0 5321 -8002 Modular Hashing ● Overall a good simple, general approach to implement a hash map ● Basic formula: ○ h(x) = c(x) mod m ■ Where c(x) converts x into a (possibly) large integer ● Generally want m to be a prime number ○ Consider m = 100 ○ Only the least significant digits matter ■ h(1) = h(401) = h(4372901) Collision Resolution ● A strategy for handling the case when two or more keys to be inserted hash to the same index. ● Closed Addressing § Separate Chaining ● Open Addressing § Linear Probing § Quadratic Probing § Double Hashing Separate Chaining ● Make each cell of hash table point to a linked list of records that have same hash function value Key Hash Value S 2 0 E 0 1 A 0 2 R 4 3 C 4 4 H 4
Hashing (part 2) CSE 2011 Winter 2011 14 March 2011 1 Collision Handling Separate chaining Pbi(Probing (open a ddress ing ) Linear probing Quadratic probing Double hashing 2 1 Quadratic Probing Linear probing: Quadratic probing Insert item (k, e) A[i] is occupied i = h(k) Try A[(i+1) mod N]: used A[i] is occupied Try A[(i+22) mod N]: used Try A[(i+1) mod N]: used Try A[(i+32) mod N] Try A[(i+2) mod N] and so on and so on until an empty cell is found May not be able to find an empty cell if N is not prime, or the hash table is at least half full 3 Double Hashing Double hashing uses a Insert item (k, e) secondary hash function i = h(()k) d(k) and handles collisions A[i] is occupied by placing an item in the first available cell of the Try A[(i+d(k))mod N]: used series Try A[(i+2d(k))mod N]: used (i j d(k)) mod N Try A[(i+3d(k))mod N] for j 0, 1, … , N 1 and so on until The secondary hash an empty cell is found function d(k) cannot have zero values The table size N must be a prime to allow probing of all the cells 4 2 Example of Double Hashing kh(k ) d (k ) Probes Consider a hash 18 5 3 5 tbltable s tor ing itinteger 41 2 1 2 22 9 6 9 keys that handles 44 5 5 5 10 collision with double 59 7 4 7 32 6 3 6 hashing 315 4 590 N 13 73 8 4 8 h(k) k mod 13 d(k) 7 k mod 7 0123456789101112 Insert keys 18, 41, 22, 44, 59, 32, 31, 73, in this order 31 41 18 32 59 73 22 44 0123456789101112 5 Double Hashing (2) d(k) should be chosen to minimize clustering Common choice of compression map for the secondary hash function: d(k) q k mod q where q N q is a prime The possible values for d(k) are 1, 2, … , q Note: linear probing has d(k) 1.
Linear Probing with Constant Independence Anna Pagh, Rasmus Pagh, and Milan Ruˇzi´c IT University of Copenhagen, Rued Langgaards Vej 7, 2300 København S, Denmark. Abstract. Hashing with linear probing dates back to the 1950s, and is among the most studied algorithms. In recent years it has become one of the most important hash table organizations since it uses the cache of modern computers very well. Unfortunately, previous analysis rely either on complicated and space consuming hash functions, or on the unrealistic assumption of free access to a truly random hash function. Already Carter and Wegman, in their seminal paper on universal hashing, raised the question of extending their analysis to linear probing. However, we show in this paper that linear probing using a pairwise independent family may have expected logarithmic cost per operation. On the positive side, we show that 5-wise independence is enough to ensure constant expected time per operation. This resolves the question of finding a space and time efficient hash function that provably ensures good performance for linear probing. 1 Introduction Hashing with linear probing is perhaps the simplest algorithm for storing and accessing a set of keys that obtains nontrivial performance. Given a hash function h, a key x is inserted in an array by searching for the first vacant array position in the sequence h(x), h(x) + 1, h(x) + 2,... (Here, addition is modulo r, the size of the array.) Retrieval of a key proceeds similarly, until either the key is found, or a vacant position is encountered, in which case the key is not present in the data structure.
Security of Authentication Based on a Universal Hash-Function Family
c de Gruyter 2010 J. Math. Crypt. 4 (2010), 1–24 DOI 10.1515 / JMC.2010.xxx The power of primes: security of authentication based on a universal hash-function family Basel Alomair, Andrew Clark and Radha Poovendran Communicated by xxx Abstract. Message authentication codes (MACs) based on universal hash-function families are be- coming increasingly popular due to their fast implementation. In this paper, we investigate a family of universal hash functions that has been appeared repeatedly in the literature and provide a detailed algebraic analysis for the security of authentication codes based on this universal hash family. In particular, the universal hash family under analysis, as appeared in the literature, uses operation in the finite field Zp. No previous work has studied the extension of such universal hash family when computations are performed modulo a non-prime integer n. In this work, we provide the first such analysis. We investigate the security of authentication when computations are performed over arbi- trary finite integer rings Zn and derive an explicit relation between the prime factorization of n and the bound on the probability of successful forgery. More specifically, we show that the probability of successful forgery against authentication codes based on such a universal hash-function family is bounded by the reciprocal of the smallest prime factor of the modulus n. Keywords. Cryptography, authentication, finite integer rings, universal hash-function families. AMS classification. 11T71, 94A60, 94A62. 1 Introduction and related work Message authentication code (MAC) algorithms can be categorized, based on their se- curity, into unconditionally and conditionally secure MACs.
New bounds for almost universal hash functions Abstract Using combinatorial analysis and the pigeon-hole principle, we introduce a new lower (or combinatorial) bound for the key length in an almost (both pairwise and l-wise) universal hash function. The advantage of this bound is that the key length only grows in proportion to the logarithm of the message length as the collision probability moves away from its theoretical minimum by an arbitrarily small and positive value. Conventionally bounds for various families of universal hash functions have been derived by using the equivalence between pairwise universal hash functions and error-correcting codes, and indeed in this paper another (very similar) bound for almost universal hash functions can be calculated from the Singleton bound in coding theory. However, the latter, perhaps unexpectedly, will be shown to be not as tight as our combinatorial one. To the best of our knowledge, this is the first time that combinatorial analysis has been demonstrated to yield a better universal hash function bound than the use of the equivalence, and we will explain why there is such a mismatch. This work therefore potentially opens the way to re-examining many bounds for a number of families of universal hash functions, which have been solely derived from bounds in coding theory and/or other combinatorial objects. 1 Introduction and contribution Universal hash function H with parameters (, K, M, b) was introduced by Carter and Wegman [9, 43]. Each family, which is indexed by a K-bit key k, consists of 2K hash functions mapping a message representable by M bits into a b-bit hash output.
High Speed Hashing for Integers and Strings Mikkel Thorup May 12, 2020 Abstract These notes describe the most efficient hash functions currently known for hashing integers and strings. These modern hash functions are often an order of magnitude faster than those presented in standard text books. They are also simpler to implement, and hence a clear win in practice, but their analysis is harder. Some of the most practical hash functions have only appeared in theory papers, and some of them require combining results from different theory papers. The goal here is to combine the information in lecture-style notes that can be used by theoreticians and practitioners alike, thus making these practical fruits of theory more widely accessible. 1 Hash functions The concept of truly independent hash functions is extremely useful in the design of randomized algorithms. We have a large universe U of keys, e.g., 64-bit numbers, that we wish to map ran- domly to a range [m]= 0,...,m 1 of hash values. A truly random hash function h : U [m] { − } → assigns an independent uniformly random variable h(x) to each key in x. The function h is thus a U -dimensional random variable, picked uniformly at random among all functions from U to [m]. | | Unfortunately truly random hash functions are idealized objects that cannot be implemented. More precisely, to represent a truly random hash function, we need to store at least U log2 m bits, and in most applications of hash functions, the whole point in hashing is that the universe| | is much arXiv:1504.06804v9 [cs.DS] 9 May 2020 too large for such a representation (at least not in fast internal memory).
More Analysis of Double Hashing for Balanced Allocations
More Analysis of Double Hashing for Balanced Allocations Michael Mitzenmacher⋆ Harvard University, School of Engineering and Applied Sciences michaelm@eecs.harvard.edu Abstract. With double hashing, for a key x, one generates two hash values f(x) and g(x), and then uses combinations (f(x)+ ig(x)) mod n for i = 0, 1, 2,... to generate multiple hash values in the range [0, n − 1] from the initial two. For balanced allocations, keys are hashed into a hash table where each bucket can hold multiple keys, and each key is placed in the least loaded of d choices. It has been shown previously that asymp- totically the performance of double hashing and fully random hashing is the same in the balanced allocation paradigm using fluid limit methods. Here we extend a coupling argument used by Lueker and Molodowitch to show that double hashing and ideal uniform hashing are asymptotically equivalent in the setting of open address hash tables to the balanced al- location setting, providing further insight into this phenomenon. We also discuss the potential for and bottlenecks limiting the use this approach for other multiple choice hashing schemes. 1 Introduction An interesting result from the hashing literature shows that, for open addressing, double hashing has the same asymptotic performance as uniform hashing. We explain the result in more detail. In open addressing, we have a hash table with n cells into which we insert m keys; we use α = m/n to refer to the load factor. Each element is placed according to a probe sequence, which is a permutation of the cells.