Hash Functions

CS166

Chris Pollett

Oct 1, 2012

Outline

Non-crypto Hash Functions
Crypto Hash Functions
Tiger Hash Function

Non-crypto Hash (1)

Data `X = (X_0, X_1, X_2, ..., X_(n-1))`, each `X_i` is a byte
Define `h(X) = X_0 + X_1 + X_2+ ... +X_(n-1)`
Is this a secure cryptographic hash?
Example: `X = (10101010, 00001111)`
Hash is `h(X) = 10111001`
If `Y = (00001111, 10101010)` then `h(X) = h(Y)`
Easy to find collisions, so not secure...

Non-crypto Hash (2)

Data `X = (X_0,X_1,X_2, ... ,X_(n-1))`
Suppose hash is defined as:
`quad h(X) = nX_0+(n-1)X_1+(n-2)X_2+ ... +1 cdot X_(n-1)`
Is this a secure cryptographic hash?
Note that:
`quad h(10101010, 00001111) ne h(00001111, 10101010)`
But hash of `(00000001, 00001111)` is same as hash of `(00000000, 00010001)`
Not secure, but this hash is used in the (non-crypto) application rsync

Non-crypto Hash (3)

Cyclic Redundancy Check (CRC)
Essentially, CRC is the remainder in a long division calculation
Good for detecting burst errors
Random errors unlikely to yield a collision
But easy to construct collisions
CRC has been mistakenly used where crypto integrity check is required (e.g., WEP)

Cyclic Redundancy Check Codes More Details

A k-bit frame (message) is viewed as specifying the coefficients of a degree k-1 polynomials.
For example 101 code 1x² +1x⁰.
Polynomials can be added mod 2, they can also be multiplied and divided.
In a CRC code, both sender can receiver agree on on a generator polynomial G(x) which has both its high and low order coefficient 1.
We assume the message m has length > deg(G)=r.
Let M(x) be the polynomial of the message.
To compute a checksum for a message we (1) Compute x^rM(x), (the bit sequence of this polynomial is that of M(x) shifted over r bits). (2) Divide x^rM(x) by G(x) to get a remainder R(x). (3) Send the coefficients of T(x) = x^rM(x)-R(x).

More on CRC codes.

Notice T(x) is divisible by G(x).
Suppose T(x)+E(x) arrives.
Then (T(x) +E(x))/G(x) = E(x)/G(x).
The only way an error is undetected is if this value is 0. If there was a single bit error then E(x)=xⁱ for some i which can't be divisible by G(x). So any single bit error will be detected.
If there are two errors then E(x)= xⁱ+ x^j where i>j. So E(x)= x^j(x^i-j +1). So this error will be detected provided that G(x) does not divide x^k+1 for any k up to i-j.
There are some low degree polynomials that will give this protection to very long frames (messages). For instance, x¹⁵+ x¹⁴+1 does not divide x^k +1 for any k below 32768.
If E(X) contains an odd number of terms (hence errors), then it cannot have x+1 as a factor mod 2, so if x+1 is a factor of G(x) we can catch these errors.
To see this suppose E(x)=(x+1)Q(x) had an odd number of terms. Then E(1)=(1+1)Q(1) = 0 mod 2. On the other hand substituting 1 for an odd number of terms should give 1 mod 2.
CRC codes with r check bits will detect all burst errors of length ≤ r. Such an error would look like xⁱ(x^k +x^k-1 + .. +x⁰). If G(x) has a x⁰ term, it will not have an xⁱ factor, so if the degree of the parenthesized expression if less than G(x), the remainder won't be 0.
Ethernet uses the polynomial CRC-32 :=
x³² + x²⁶ + x²³+ x²²+ x¹⁶ + x¹² + x¹¹+ x¹⁰+ x⁸+ x⁷+ x⁵+ x⁴ + x² + x¹ +1

HW Problem

Problem 5.4 How many collisions would you expect to find in the following cases? (a) Your hash function generates a 12-bit output and you hash 1024 randomly selected messages. (b) Your hash function generates an `n`-bit output and you hash `m` randomly selected messages.

Answer: (a) The odds that a given message hash `h` is not shared with another message hash `h'` of the others is `1 - 1/2^(12)`. So the odds that 1023 other message hashes are different from `h` is `(1 - 1/2^(12))^(1023)`. So the expected number of message hashes that do not have other message hashes of the same value is `1024(1 - 1/2^(12))^(1023)`. So the expected number of message hashes that do have other message hashes of the same value is `1024(1 - (1 - 1/2^(12))^(1023)) approx 226`.

(b) Replacing 1024 with `m` in the previous derivation and `2^12` with `2^n`, give the equation `m(1 - (1 - 2^(-n))^(m-1))`.

Popular Crypto Hashes

MD5 -- invented by Rivest. It produces 128 bit outputs. Note: MD5 collisions relatively easy to find.
SHA-1 -- A U.S. government standard, inner workings similar to MD5. It produces 160 bit output.
Many other hashes, but MD5 and SHA-1 are the most widely used
Hashes work by hashing message in blocks

Crypto Hash Design

Desired property: avalanche effect. That is, changes to 1 bit of input should affect about half of output bits.
Crypto hash functions consist of some number of rounds
Want security and speed
- Avalanche effect after few rounds
- But simple rounds
- Analogous to design of block ciphers

Introducing the Tiger Hash

"Fast and strong"
Designed by Ross Anderson and Eli Biham -- leading cryptographers
Design criteria
- Secure
- Optimized for 64-bit processors
- Easy replacement for MD5 or SHA-1

More on Tiger Hash

Like MD5/SHA-1, input divided into 512 bit blocks (padded)
Unlike MD5/SHA-1, output is 192 bits (three 64-bit words) -- we truncate output if replacing MD5 or SHA-1
Intermediate rounds are all 192 bits
4 S-boxes, each maps 8 bits to 64 bits
A "key schedule" is used

Tiger Outer Round

Input is `X`:
- `X = (X_0,X_1,...,X_(n-1))`
- X is split into blocks `X_i`
- Each `X_i` is `512` bits, with `X_(n-1)` potentially padded
There are `n` iterations of diagram at left -- One for each input block
Initial `(a,b,c)` constants (see book for values)
Final `(a,b,c)` is the hash
Looks like a block cipher!

Tiger Inner Rounds

Each `F_m` consists of precisely 8 rounds

`512` bit input `W` to `F_m`
`W=(w_0,w_1,...,w_7)`
`W` is one of the input blocks `X_i`

All lines are 64 bits
The `f_(m,i)` depend on the S-boxes (next slide)

Tiger Hash: One Round

Each `f_(m,i)` is a function of `a,b,c,w_i` and `m`.
- Input values of `a,b,c` from previous round
- And `w_i` is 64-bit block of 512 bit `W`
- Subscript `m` is multiplier
- And `c = (c0,c1,...,c7)`
Output of `f_(m,i)` is
- `c = c oplus w_i`
- `a = a - (S_0[c_0] oplus S_1[c_2] oplus S_2[c_4] oplus S_3[c_6])`
- `b = b + (S_3[c_1] oplus S_2[c_3] oplus S_1[c_5] oplus S_0[c_7])`
- `b = b cdot m`
Each `S_i` is S-box: 8 bits mapped to 64 bits

Tiger Hash Key Schedule

Input is `X`
`X=(x_0,x_1,...,x_7)`.
Small change in X will produce large change in key schedule output

Tiger Hash Summary (1)

Hash and intermediate values are 192 bits
24 (inner) rounds
- S-boxes: Claimed that each input bit affects a, b and c after 3 rounds
- Key schedule: Small change in message affects many bits of intermediate hash values
- Multiply: Designed to ensure that input to S-box in one round mixed into many S-boxes in next
S-boxes, key schedule and multiply together designed to ensure strong avalanche effect

Tiger Hash Summary (2)

Uses lots of ideas from block ciphers
- S-boxes
- Multiple rounds
- Mixed mode arithmetic
At a higher level, Tiger employs
- Confusion
- Diffusion

HMAC

Can compute a MAC of the message M with key K using a hashed MAC or HMAC
HMAC is a keyed hash
Why would we need a key? (To make sure someone doesn't swap both the message and the hash)
How to compute HMAC?
Two obvious choices: `h(K,M)` and `h(M,K)` (prepend or append key to message).
Which is better?

HMAC - Which Way?

Should we compute HMAC as `h(K,M)` ?
Hashes computed in blocks
- `h(B_1,B_2) = F(F(A,B1),B2)` for some `F` and constant `A`
- Then `h(B_1,B_2) = F(h(B_1),B_2)`
Let `M' = (M,X)`
- Then `h(K,M') = F(h(K,M),X)`
- Attacker can compute HMAC of `M` without `K`
Is `h(M,K)` better?

The Right Way to HMAC

Described in RFC 2104
Let `B` be the block length of hash, in bytes -- `B = 64` for MD5 and SHA-1 and Tiger
`ipad = 0x36` repeated `B` times
`opad = 0x5C` repeated `B` times
Then
`HMAC(M,K) = h(K oplus opad, h(K oplus ipad, M))`

Hash Uses

Authentication (HMAC)
Message integrity (HMAC)
Message fingerprint
Data corruption detection
Digital signature efficiency
Anything you can do with symmetric crypto
Also, many, many clever/surprising uses...