Cryptographic Hash Functions Recent Results on Cryptanalysis and their Implications on System Security RudigerÄ Weis1 and Stefan Lucks2 1 Technical University of Applied Sciences Berlin 2 University of Mannheim Abstract. Recently, several severe attacks against cryptographic hash functions where discovered. This includes attacks against MD4 and MD5, two rather old hash functions. Very unfortunately, MD5 is still widely used in practice in many software integrity schemes, including, but not limited to the most popular Linux packet formats. This may pose a serious security problem. In this paper we discuss the current state of research on hash functions and some ¯rst-aid workarounds. We briefely discuss the trouble \Trusted" Computting has got into, by trusting the SHA-1 hash function which now has been broken. A spectre is haunting IT-security { the spectre of hash function cryptanalysis. Hash functions, the cryptographic workhorses for data authenticity and integrity, are broken one by one. There are three kinds of attacks: { structural weaknesses, { analytical weaknesses, and { exploits of both. In the current paper, we briey explain how current hash func- tions work, which attacks cryptographic hash functions should de- fend against, and what had gone wrong now (Section 1). More specif- ically, we describe how to exploit the currently known weaknesses, and discuss their practical consequences (Section 2), including the trouble for \Trusted" Computing, due to the \hardwired" use of SHA-1, and the risks of still using MD5 (3). We further describe the immediate consequences for the \users" of hash functions (Section 4) and an outlook on future development (Section 5). Finally, we give a short summary (Section 6). 1 Hash Functions and Attacks A cryptographic hash function H : f0; 1g¤ ! f0; 1gn maps an in¯nite set of inputs to the ¯nite set of n-bit hash values. Informally, a real hash function H should behave like an ideal one (i.e., like a random oracle). This would not be useful for a formal de¯nition, though. Instead, one considers somewhat simpler security goals for H : f0; 1g¤ ! f0; 1gn. While collisions (inputs X =6 Y with H(X) = H(Y )) necessar- ily exist, as there are more inputs than outputs, a hash function should be collision resistant: given H, it should be infeasible for an adversary to actually ¯nd any collisions. Additionally, a hash function should resist preimage and 2nd preimage attacks: Given Z, it should be infeasible for an adversary to ¯nd any X with H(X) = Z, and given Y , it should be infeasible to ¯nd Y with H(X) = H(Y ). Classes of Attacks A bit more formally, we distinguish the following classes of attacks: Collision attack: Find two messages M =6 M 0 with H(M) = H(M 0). Preimage attack: Given a random value Y 2 f0; 1gn, ¯nd a mes- sage M with H(M) = Y . 2nd preimage attack: Given a message M, ¯nd a message M 0 =6 M with H(M) = H(M 0). K-collision attack for K ¸ 2: Find K di®erent messages M i, with H(M 1) = ¢ ¢ ¢ = H(M K ). K-way (2nd) preimage attack for K ¸ 1: Given Y (or M with H(M) = Y ), ¯nd K di®erent messages M i, with H(M i) = Y (and M i =6 M). The last two are natural generalisations of the more `traditional" collision attacks (2-collisions) and `1-way" preimage and 2nd preim- age attacks. We compare the resistance of a given hash function against these attacks with the resistance a random oracle would pro- vide: Fact: Model H : f0; 1g¤ ! f0; 1gn as a random oracle. Finding a K-collision for H takes time ¼ 2(K¡1)¢n=K , and ¯nding a K-way preimage or a K-way 2nd preimage for H takes time ¼ K ¢ 2n. 2 Special case: Finding a \normal" (2-)collision for a random oracle H takes time ¼ 2n=2 and ¯nding a preimage or a 2nd preimage takes time ¼ 22n. 1.1 Hash Functions and Digital Signatures Why is it so important for a hash function to be 2nd preimage re- sistant and even collision resistant? Why is it so dangerous if a hash function does not defend against ¯nding 2nd preimages or collisions? As a motivating example, consider digital signature schemes. A message M has to be signed. The signature scheme is broken, if the adversary can forge a signature for another message M 0. In practise, cryptographic signature schemes follow the hash-and-sign paradigm: Instead of signing the (potentially very long) message M, one actu- ally computes a short \¯ngerprint" H(M) and signs X. Given a signature for some message M, and adversary able to compute a 2nd preimage M 0 with H(M) = H(M 0) is able to forge a signature for M 0, as the signature for M is valid as well for M 0. So much about the importance of 2nd preimage resistance. But why is collision resistance a big deal? 2nd preimage resistance is ¯ne { if we always trust the party who chooses the message M to be signed. But if we don't, we need collision resistance! Otherwise, the adversary could compute the col- lision M =6 M 0, sign M or present M to be signed, and later claim the signature on M 0. 1.2 Structural Weaknesses of Today's Hash Functions The design of today's cryptographic hash functions, including but not limited to MD4, MD5, SHA-0, SHA-1, SHA-2 family, RIPEMD, RIPEMD-160, Whirlpool, Tiger, . ubiquitously follows the MD structure by Merkle and Damgºard (MD) [19, 5] for hash functions. As a hash function H : f0; 1g¤ ! f0; 1gn has to handle arbitrarily long inputs1, the idea is to design an internal compression function C : f0; 1gn£f0; 1gm ! f0; 1gn with ¯xed input size, to split the given message M into m-bit blocks M[1], . , M[L] (with some padding in 1 In practise, the input size of of all these hash function is limited to some ¯xed upper bound. As this bound is at least 264 bit, this is hardly a practical limitation. 3 the ¯nal block M[L]), and to compute the hash by straightforwardly iterating the compression C, as shown in Figure 1. C C C H[0] H[1] H[2] H[L−1] H[L] M[1] M[2] M[L] Fig. 1. The iterated Merkle-Damgºard (MD) structure for hash functions As shown in [19, 5], the hash function h is collision resistant, if the compression function is. This is the strong point of the MD structure. Unfortunately, there is a weak point, as well: the MD structure is rather failure-unfriendly { if computing a compression function collision is somehow feasible, all the bets are o®. In fact, it had turned out that these hash functions failed worse than expected. Length Extension Attacks The length extension property is a well-known generic weakness of the MD hash (see e.g. [8, Section 6.3.1]): Given H = H(M); it is straightforward to compute M 0 and H0, such that H0 = H(MjjM 0) { even for unknown M. (For the correct padding of the ¯nal message block, one needs to know the length of M.) 2nd Collision Attacks Once you have found a collision, it is trivial to produce more such collisions: If H(M) = H(N) for any two messages M, N, then H(MjjS) = H(NjjS) for all S 2 f0; 1gn. 4 Multiple Collisions Finding multiple collisions should be way more expensive than ¯nd- ing plain (2-)collisions { but Joux [15] disproved this for the MD design. He described a generic attack to ¯nd 2k-Collisions for a MD k k hash H in time ¼ k ¢ 2n=2, instead of ­(2n(2 ¡1)=2 ): For i in 1 . , k: 0 1 ! Find a local collision Mi =6 Mi with 0 1 Hi = C(Hi¡1; Mi ) = C(Hi¡1; Mi ): All the 2k messages 0 0 0 0 1 1 1 (M1 ; : : : ; Mk ); (M1 ; : : : ; Mk¡1; Mk ); : : : ; (M1 ; : : : ; Mk ) hash to the same value Hk. (Note that all messages are of the same (not too large) size of k blocks.) Using Joux' multicollision attack as a tool As Joux pointed out [15], the adversary's ability to ¯nd large K- collisions opens the door for further attacks. Below, we sketchily describe them. Attacking cascaded hash functions. Let a hash H : f0; 1g¤ ! f0; 1gn be de¯ned as H(M) = H1(M)jjH2(M) with two independent n-bit hashes H 1 and H2. If both H1 and H2 are independently de¯ned as random oracles, then ¯nding collisions for H takes time 2n. If, however, either is constructed as a MD hash, ¯nding a collision for H only takes time ¼ (n=2) ¤ 2n=2: W.l.o.g., let H1 be the MD hash: ! Find 2(n=2)-collisions for H1 (in (n=2) ¤ 2n=2 units of time). Sta- tistically, one such collision also collides for H 2 (and thus for H). 5 Finding multiple (2nd) preimages. Given a target Y 2 f0; 1gn, the attack proceeds as follows: k ! Generate 2k colliding k-block messages M 1, . , M 2 with 1 2k Hk = H(M ) = ¢ ¢ ¢ = H(M ): ! Find a message chunk Mk+1, such that C(Hk; Mk+1) = Y . This provides a 2k-way preimage. The ¯rst step takes time k ¤ 2n=2, which is marginal, compared to the second step. This takes about the time for a single preimage attack, i.e., ¼ 2n. For a 2nd preimage message attack with the target message M, just set Y := H(M).