and Hashes Integrity
Peter Sjdin [e-mail]
Based on material by Vitaly Shmatikov, Univ. of Texas, and by the previous course teachers
1
Motivation: Integrity
VIRUS
badFile goodFile
The Times
BigFirm
hash(goodFile)
User
Software manufacturer wants to ensure that the executable file is received by users without modification. It sends out the file to users and publishes its hash in NY Times. The goal is integrity, not secrecy Idea: given goodFile and hash(goodFile), very hard to find badFile such that hash(goodFile)=hash(badFile)
2
Integrity vs. Secrecy
Integrity: attacker cannot tamper with message Encryption per se does not guarantee integrity
Intuition: attacker may able to modify message under encryption without learning what it is This is recognized by industry standards (e.g., PKCS)
RSA encryption is intended primarily to provide confidentiality It is not intended to provide integrity (from RSA Labs Bulletin)
Some encryption schemes provide secrecy AND integrity
3
Motivation: Authentication
KEY KEY
msg, hash(KEY,msg)
Alice
Ensures both integrity and authentication (why?)
Bob
Alice wants to make sure that nobody modifies message in transit Idea: given msg, very hard to compute hash(KEY,msg) without KEY
Very easy with KEY
4
Hash Functions: Main Idea
message
x
.
hash function H
message digest
x
. x .
.y . y
bit strings of any length H is a lossy compression function
Collisions: H(x)=H(x) for some inputs x, x Result of hashing should look random
n-bit bit strings
Intuition: half of digest bits are 1; any bit in digest is 1 half the time
Any two outputs should be uncorrelated differ by half of the bits
Cryptographic hash function needs a few properties
5
One-Way
Intuition: hash should be hard to invert
For any given y, it should be hard to find any x such that H(x)=y
How hard?
Brute-force: try every possible x, see if H(x)=y SHA-1 (common hash function) has 160-bit output
Suppose have hardware thatll do 230 trials a pop Assuming 234 trials per second, can do 289 trials per year Will take 271 (1021) years to invert SHA-1 on a random image
6
Collision Resistance
Finding a message that matches a given n-bit digest, means trying 2n combinations
264 is a very large number
However, finding two messages that map to the same nbit digest means trying approximately 2n/2 combinations
232 is not so large Considered computationally feasible
7
Birthday Problem
Birthday paradox The number of possible pairs grows rapidly
Probability of birthday collision in a group of N people
8
Which Property Do We Need?
UNIX passwords stored as hash(password)
One-wayness: hard to recover password
Integrity of software distribution
Collision resistance: hard to modify software with preserved hash
Auction bidding
Alice wants to bid B, sends H(B), later reveals B One-wayness: rival bidders should not recover B Collision resistance: Alice should not be able to change her mind to bid B such that H(B)=H(B)
9
Common Hash Functions
MD5 (Message-Digest algorithm 5)
128-bit output Designed by Ron Rivest, used very widely Collision-resistance weaknesses found (summer of 2004) MD6 160-bit variant of MD5 160-bit output SHA-1
US government (NIST) standard as of 1993-95 Also the hash algorithm for original Digital Signature Standard (DSS) Weaknesses found in 2005
RIPEMD-160
SHA Family (Secure Hash Algorithm)
SHA-2
weaknesses No found, but similar design
SHA-3, work in progress
NIST hash function competition Submissions due Oct 2008
10
Block Ciphers
Block of plaintext S S S S S S S S Key
For hashing, there is no KEY. Use message as key and replace plaintext with a fixed string.
(for example, Unix password hash is DES applied to NULL with password as the key)
repeat for several rounds
S
S
S
S
Block of ciphertext
12
SHA-1 Compression Function
Current buffer (five 32-bit registers A,B,C,D,E). Initialized with magic values. Current message block Four rounds, 20 steps in each
Lets look at each step in more detail
Very similar to a block cipher, with message itself used as the key for each round
Fifth round adds the original buffer to the result of 4 rounds
Buffer contains final hash value
13
One Step of SHA-1 (80 steps total)
A B
Logic function for steps
(BC)(BD) BCD (BC)(BD)(CD) BCD 0..19 20..39 40..59 60..79
C ft
D
E + +
5 bitwise left-rotate
Current message block mixed in
For steps 0..15, W0..15=message block For steps 16..79, Wt=Wt-16Wt-14Wt-8Wt-3
Multi-level shifting of message blocks 30 bitwise left-rotate
+ + E
Wt Kt
Special constant added
(same value in each 20-step round, 4 different constants altogether)
A
B
C
D
14
How Strong Is SHA-1?
Every bit of output depends on every bit of input
Very important property for collision-resistance
Brute-force inversion requires 2160 ops, birthday attack on collision resistance requires 280 ops Weaknesses (2005)
Collisions can be found in 263 ops
15
Authentication Without Encryption
KEY
MAC
(message authentication code)
KEY
message, MAC(KEY,message)
Alice
message
? =
Bob
Recomputes MAC and verifies whether it is equal to the MAC attached to the message
Integrity and authentication: only someone who knows KEY can compute MAC for a given message
16
HMAC
Construct MAC by applying a cryptographic hash function to message and key Could use encryption instead, but
Hashing is faster than encryption in software Library code for hash functions widely available Can easily replace one hash function with another There were US export restrictions on encryption
Invented by Bellare, Canetti, and Krawczyk (1996)
HMAC strength established by cryptographic analysis
Mandatory for IP security, also used in SSL/TLS
17
Extension Attacks
A too simple solution:
compute H(k|M) were k is a secret key Hash is computed iteratively over the message: extend the message at the end
HMAC uses the hash function twice, with two derived subkeys
k a, k b The two constants a and b (ipad, opad) are not secret
Possible approaches: Add the length of the message
H(k|length|M)
Second time, hash subkey and the first hash:
H( k a | H( k b | M) )
Add the key at the end
H(M|k)
Or both:
H(k|M|k)
Structure of HMAC
magic value (flips half of key bits) Secret key padded to block size
Block size of embedded hash function
another magic value
(flips different key bits)
Embedded hash function
(strength of HMAC relies on strength of this hash function)
Black box: can use any hash function (why is this important?)
Amplify key material
(get two keys out of one)
Very common problem: given a small secret, how to derive a lot of new keys?
hash(key,hash(key,message))
19
Reading Assignment
Read Kaufman 5.1-2 and 5.6-7 Note that there are elaborated reading instructions on the course web!
20