Cryptographic Hash Functions and their many applications密码杂凑函数及其应用.pptVIP

Cryptographic Hash Functionsand their many applications Shai Halevi – IBM Research USENIX Security – August 2009 What are hash functions? Just a method of compressing strings E.g., H : {0,1}* ? {0,1}160 Input is called “message”, output is “digest” Why would you want to do this? Short, fixed-size better than long, variable-size True also for non-crypto hash functions Digest can be added for redundancy Digest hides possible structure in message How are they built? Typically using Merkle-Damg?rd iteration: Start from a “compression function” h: {0,1}b+n?{0,1}n Iterate it What are they good for? “Request for Candidate Algorithm Nominations”, -- NIST, November 2007 Some examples Signatures: sign(M) = RSA-1( H(M) ) Message-authentication: tag=H(key,M) Commitment: commit(M) = H(M,…) Key derivation: AES-key = H(DH-value) Removing interaction [Fiat-Shamir, 1987] Take interactive identification protocol Replace one side by a hash function Challenge = H(smthng, context) Get non-interactive signature scheme Some things that we want Collision resistance (commitment, signatures) Hard to find M?M’ for which H(M)=H(M’) One-way (commitment) Given d, hard to find M such that H(M)=d Unpredictability (authentication) M?H(R,M) unpredictable when R is secret Extraction (key derivation) If M has high entropy then H(M) is ~ uniform What’s needed for the Fiat-Shamir transformation? Some other form of “unpredictability” (?) Part I: Random functions vs. hash functions Random functions What we really want is H that behaves “just like a random function”: Digest d=H(M) chosen uniformly for each M Digest d=H(M) has no correlation with M For distinct M1,M2,…, digests di=H(Mi) are completely uncorrelated to each other Cannot find collisions, or even near-collisions Cannot find M to “hit” a specific d Cannot find fixed-points (d = H(d)) etc. The “Random-Oracle paradigm” Pretend hash function is really this go