NoteNextra-origin/content/CSE4303/CSE4303_L9.md

CSE4303 Introduction to Computer Security (Lecture 9)

Cryptographic Hash Functions

What is a Hash Function

A hash function maps a variable-length input to a fixed-length output.

h : X \to Y

Typical examples:

• Java hashCode(): input is an Object, output is a 4-byte integer.
• String polynomial hash example: h("cs433s") = 'c' \cdot 31^6 + 's' \cdot 31^5 + \dots + 's'

Key property:

• Domain |X| is much larger than range |Y|.
• Collisions are unavoidable in principle since |X| > |Y|.

Main uses:

• Compact numerical representation
• Hash tables (Set, Map, dictionaries)
• Object comparison
• Integrity checking (fingerprint)

Security Properties

Let h : X \to Y.

1. Preimage Resistance (One-way)
   Given y \in Y, it is computationally infeasible to find x \in X such that
   h(x) = y.

2. Second Preimage Resistance (Weak collision resistance)
   Given a specific x \in X, it is computationally infeasible to find x' \neq x such that
   h(x') = h(x).

3. Collision Resistance (Strong collision resistance)
   It is computationally infeasible to find any two distinct values x, x' \in X such that
   h(x) = h(x').

Adversarial definition:

Let H : M \to T where |M| is much larger than |T|.
H is collision resistant if for all efficient algorithms A:

Adv_{CR}[A, H] = Pr[A outputs a collision for H]

is negligible.

Generic Collision Attack (Birthday Attack)

Let H : M \to \{0,1\}^n.

Generic algorithm to find a collision in time on the order of 2^{n/2}:

1. Choose 2^{n/2} random messages m_1, \dots, m_{2^{n/2}}.
2. Compute t_i = H(m_i).
3. Look for t_i = t_j.

Birthday phenomenon:

If the output space size is B,
high collision probability greater than 50\% occurs with about \sqrt{B} samples.

Thus:

• 128-bit hash gives about 2^{64} collision attack
• 256-bit hash gives about 2^{128} collision attack

Practical Hash Functions

From performance and security table (AMD Opteron 2.2 GHz):

• MD5: 128 bits, completely broken since 2004
• SHA-1: 160 bits, practical collision attack demonstrated
• SHA-256: 256 bits
• SHA-512: 512 bits
• Whirlpool: 512 bits

SHA-1 collision example: SHAttered attack (Google and CWI).
Two different PDF files were produced with identical SHA-1 hash.

Construction of Cryptographic Hash Functions

Merkle-Damgard Construction

Given compression function:

h : T \times X \to T

We build:

H : X^{\le L} \to T

Process:

• Split message into blocks m[0], m[1], \dots, m[L].

• Use fixed initialization vector IV.

• Iterate chaining:

  H_0 = IV
H_1 = h(H_0, m[0])
H_2 = h(H_1, m[1])
\dots
H_L = h(H_{L-1}, m[L])

• Apply padding: append 1000\ldots0 concatenated with message length (64 bits).
  If no space remains, add another block.

Theorem:
If compression function h is collision resistant,
then H is collision resistant.

Davies-Meyer Compression from Block Cipher

Given block cipher:

E : K \times \{0,1\}^n \to \{0,1\}^n

Define compression function:

h(H, m) = E(m, H) \oplus H

If E behaves like an ideal cipher,
finding a collision in h takes about 2^{n/2} evaluations.

This is optimal for $n$-bit output.

Example: SHA-256

Built using:

• Merkle-Damgard construction
• Davies-Meyer style compression
• Block cipher-like core: SHACAL-2

Structure:

• 512-bit message block
• 256-bit chaining value
• 256-bit output

Applications for Integrity and Authentication

Standalone Usage: Message Integrity

Application 1: Delayed Knowledge Verification

Idea: Publish h(secret) first.
Later reveal secret.
Anyone can recompute hash and verify.

Justification: Preimage resistance ensures secret is hidden until revealed.

Example: Stock market prediction commitment.

Example for delayed knowledge verification

1. Publish H("Stock will rise on May 1").
2. On May 1, reveal the prediction string.
3. Anyone computes hash and checks equality.

Application 2: Password Storage

Model: System must verify password but not store plaintext.

Solution: Store hash of password.
During login:

• Hash input
• Compare with stored value

Example: Linux stores hashed passwords in the /etc/shadow file.
Includes:

• Salt
• Password hash
• Metadata

Security relies on:

• One-way property
• Salting to prevent precomputed attacks

Application 3: Trusted Timestamping and Blockchains

Goal: Prove document existed before a given date.

Methods:

• Publish document hash in newspaper.
• Time Stamping Authority signs hash.
• Publish hash in blockchain block.

Blockchain relies on:

• One-way hash functions
• Linking blocks via hash pointers

Application 4: Software Integrity with Secure Read-Only Space

Context: Trusted read-only public space (for example official website).

Process:

1. Publisher computes H(F_1), H(F_2), \dots, H(F_n).
2. Publish hashes publicly.
3. User downloads file F_i and verifies hash.

If H is collision resistant:
Attacker cannot modify file without detection.

No encryption required.
Public verifiability works if read-only space is trusted.

Symmetric Crypto Authentication: MACs and AE

Message Authentication Codes (MACs)

Definition: MAC I = (S, V) over (K, M, T)

• S(k, m) \to t
• V(k, m, t) \to yes or no

Security model: Attacker can query S(k, m_i).
Goal: produce new (m, t) not previously seen such that V accepts.

Adv_{MAC}[A, I] must be negligible.

MAC from PRF

Given PRF:

F : K \times X \to Y

Define MAC:

S(k, m) = F(k, m)
V(k, m, t) accepts if t = F(k, m)

Theorem: If F is secure PRF and |Y| is large,
then derived MAC is secure.

Condition: 1 / |Y| must be negligible.
Example: |Y| = 2^{80}.

MACs from Hash Functions

Construction:

S_{big}(k, m) = S(k, H(m))
V_{big}(k, m, t) = V(k, H(m), t)

If:

• S is secure MAC for short messages
• H is collision resistant

Then S_{big} is secure MAC.

If collision exists: If H(m_0) = H(m_1), query tag for m_0, forge (m_1, t).

HMAC

HMAC(k, m) = H((k \oplus opad) \| H((k \oplus ipad) \| m))

Used in:

• TLS
• IPsec
• SSH

Properties:

• Built from hash function (for example SHA-256)
• Provably secure under PRF assumptions

Timing Attacks on MAC Verification

Problem: Byte-by-byte comparison leaks timing information.

Attack:

1. Send random tag.
2. Guess first byte.
3. Detect timing increase.
4. Repeat per byte.

Defense 1: Constant-time comparison loop.

Defense 2: Double-HMAC comparison: Compare HMAC(k, mac) with HMAC(k, sig).

Authenticated Encryption (AE)

AE provides:

1. Confidentiality (CPA security)
2. Ciphertext integrity

Cipher:

E : K \times M \times N \to C
D : K \times C \times N \to M \cup \{\bot\}

Ciphertext integrity: Attacker cannot produce new valid ciphertext.

Theorem: AE implies CCA security.

Implication: If D(k, c) \neq \bot,
receiver knows sender had key.

Encrypt-then-MAC

Correct construction:

1. Compute c = E(k_E, m)
2. Compute tag = S(k_I, c)
3. Send (c, tag)

Encrypt-then-MAC is always secure ordering.

AE Standards

• GCM: CTR mode encryption then polynomial MAC
• CCM: CBC-MAC then CTR mode encryption
• EAX: CTR mode encryption then CMAC

All support AEAD: Authenticated Encryption with Associated Data.
Example: authenticate packet headers but do not encrypt them.

Asymmetric Crypto Authentication: Digital Signatures

Motivation

Goal: Bind document to author.

Digital problem: Anyone can copy a visible signature from one document to another.

Solution: Make signature depend on document contents.

Digital Signature Scheme

Components:

• Secret signing key sk
• Public verification key pk
• Sign(sk, m) \to signature
• Verify(pk, m, sig) \to accept or reject

Property: Anyone can verify.
Only signer can produce valid signature.

Signing a Certificate

Process:

1. Compute hash of data.
2. Sign hash with secret key.
3. Attach signature to data.

Verification:

1. Compute hash of received data.
2. Verify signature using public key.
3. Accept if hashes match.

Software Signing

Software vendor:

• Signs update with secret key.
• Publishes update and signature.

Clients:

• Use vendor public key.
• Verify signature.
• Install only if valid.

Allows distribution via untrusted hosting site.

Review: Three Approaches to Data Integrity

1. Collision resistant hashing
   Requires secure read-only public space.
   No secret keys.
   Suitable for public verification.

2. MACs
   Requires shared secret key.
   Must compute new MAC per user.
   Suitable when one signs and one verifies.

3. Digital signatures
   Requires long-term secret key.
   Public verification.
   Suitable when one signs and many verify.

Crypto Summary

Cryptographic goals:

• Confidentiality
• Data integrity
• Authentication
• Non-repudiation

Primitives:

• Hash functions
• MACs
• Digital signatures
• Symmetric ciphers
• Public key ciphers