Академический Документы
Профессиональный Документы
Культура Документы
Spring 2006
http://www.abo.fi/~ipetre/crypto/
Message authentication
Goal here: having received a message one would like to make sure that the message has not been altered on the way
Produce a short sequence of bits that depends on the message and on a secret key To authenticate the message, the partner will compute the same bit pattern, assuming he shares the same secret key
Authentication functions
Three types of authentication exist
Message encryption the ciphertext serves as authenticator Message authentication code (MAC) a public function of the message and a secret key producing a fixed-length value to serve as authenticator
This does not provide a digital signature because A and B share the same key
Hash function a public function mapping an arbitrary length message into a fixed-length hash value to serve as authenticator
This does not provide a digital signature because there is no key
Encryption as authenticator
Encryption as authenticator
Some careful considerations are needed here:
How does B recognize a meaningful message from an arbitrary sequence of bits?
He can apply the decryption key to any sequence of bits he receives
This is not necessarily easy task if the message is some sort of binary file Immediate idea of attack: send arbitrary bit sequences to disrupt the receiver he will try to figure out the meaning of that bit sequence
Defense against this type of attack: add to the message a certain structure such as an error-correcting code (e.g., check-sum bits) and then encrypt the whole file
B will detect illegitimate messages because they will not have the required structure
Often one needs alternative authentication schemes than just encrypting the message
Sometimes one needs to avoid encryption of full messages due to legal requirements Encryption and authentication may be separated in the system architecture If a message is broadcast to several destinations in a network (such as a military control center), then it is cheaper and more reliable to have just one node responsible to evaluate the authenticity message will be sent in plain with an attached authenticator If one side has a heavy load, it cannot afford to decrypt all messages it will just check the authenticity of some randomly selected messages If the message is sent encrypted, it is of course protected over the network. However, once the receiver decrypts the message, it is no longer secure. Using a different type of authentication protects the message also on the local computer
To generate the MAC of a message M, Alice gives M and the secret key K to a MAC function C: MAC=CK(M)
Alice will send M plus the MAC to Bob Bob has the same secret key K and generates the MAC himself to check the match
10
11
A fixed-length hash value h is generated by a function H that takes as input a message of arbitrary length: h=H(M)
A sends M and H(M) B authenticates the message by computing H(M) and checking the match
Note: the hash function is not considered secret some other means are required to protect it Note 2: Hash function plus secrecy (key) gives a MAC these are called HMACs
12
a.
Classical encryption of message+hash Only the hash value is encrypted As in (b) but with public key (provides digital signature)
b.
c.
13
d.
Hash is encrypted with an asymmetric system, then a second encryption is applied No encryption here but the hash is applied to a message where a secret text S has been appended As in (e), but with encryption
e.
f.
14
15
Another example: rotated XOR before each addition the hash value is rotated to the left with 1 bit
Better than the previous hash on text files Similar attack
Birthday paradox
Given at least 23 people, the probability of having two people with the same birthday is more then 0.5 Related problem: Given two sets X,Y each having k elements from the set {1,2,,N}, how large should k so that the probability that X and Y have a common element is more than 0.5?
Answer: k should be larger than the square root of N If N=2m, take k=2m/2
17
Birthday attack
Suppose a hash value on 64 bits is used (as the one based on DES)
In principle this is secure: to find a message M with H(M)=H(M), one apparently has to generate in average 263 messages M
18
{This letter is / I am writing} to introduce {you to / to you} {Mr. / } Alfred {P. / } Barton, the {new / newly appointed} {chief / senior} jewelry buyer for {our / the} Northern {European / Europe} {area / division}. He {will take /has taken} over {the / } responsibility for {all / the whole of} our interests in {watches and jewelry / jewelry and watches} in the {area/region}.
19
20
MD5
Most popular hash algorithm until very recently concerns for its security were raised and was proposed to be replaced by SHA-1 Developed by Rivest at MIT For a message of arbitrary length produces an output of 128 bits
Processes the input in blocks of 512 bits
Idea:
Start by padding the message to a length of 448 bits modulo 512 padding is always added even if the message is of required length; the length of the message is added on 64 bits so that altogether the length is a multiple of 512 bits Several rounds, each round takes a block of 512 bits from the message and mixes it thoroughly with a 128 bit buffer that was the result of the previous round The last content of the buffer is the hash value
21
MD5
22
1. 2.
If the length is larger than 264, take the 64 least representative bits
3.
4.
Initialize MD buffer with the following 4 values, all on 32 bits: A=0x01234567, B=0x89ABCDEF, C=0xFEDCBA98, D=0x76543210 Process each message block of 512 bits in 4 rounds
Each round takes as input the 512 bits in the input and the content of the buffer ABCD and updates the buffer ABCD (details on the next slide) The four words A,B,C,D in the output of the 4th round are added modulo 232 to the corresponding words A,B,C,D of the input to the first round
5.
Output: the 128 bits in the buffer ABCD after the last round
23
24
All operations here are on blocks of 32 bits T is a table g is one of the functions F,G,H,I (bit-wise function) X has the current 32 bits of the message CLSs is a circular left shift (rotation) with s bits + is addition modulo 232
25
26
Strength of MD5
Every bit of the output is a function of all bits of the input Rivests conjecture:
As strong as it can be for a 128-bit hash: birthday attack on the order of 264 and finding a message with a given digest is on the order of 2128
27
Design based on MD4 (previous version of MD5) Takes as input any message of length up to 264 bits and gives a 160-bit message digest Same structure as MD5, with block length of 512 bits and buffer of 160 bits
28
SHA-1 scheme
1.
2.
3.
4.
Append padding bits: message is padded so that length is congruent to 448 modulo 512; padding always added one bit 1 followed by the necessary number of 0 bits Append length: a block of 64 bits containing the length of the original message is added Initialize 160-bit MD buffer: this is formed by 32-bit registers A,B,C,D,E. Initial values: A=0x67452301, B=0xEFCDAB89, C=0x98BADCFE, D=0x10325476, E=C3D2E1F0 Process message in blocks of 512 bits (i.e., 16 words of 32 bits each)
Four rounds with 20 steps each (on next slide) Each round takes as input the current 512-bit input block and the 160-bit buffer ABCDE and updates the buffer there is an addition modulo 232
5.
Output: the final content of the buffer gives the message digest
29
30
ft is one of the functions f1,f4 on B,C,D Sk is a circular left shift by k bits W is a 32-bit block derived from the current 512-bit input, changing in every step K is the constant defined earlier Addition is modulo 232
31
32
33
Strength of SHA-1
Stronger than MD5 because of longer message digest Slower than MD5 because of more rounds No known attacks
Secret design criteria
Variants of SHA-1 with longer message digests have also been proposed: SHA-256, SHA-384, SHA-512 (n-bit hash for SHA-n)
34
HMAC
Interest in recent years in developing a MAC based on a hash function
MD5 and SHA-1 run faster than symmetric block ciphers such as DES Code for hash functions widely available No export restrictions for cryptographic hash functions
Cryptographic functions (even those used in MAC) restricted
Hash values not intended for MAC they are not protected by secret keys
Some protection needs to be built on top of the hash value
The one approach that gained wide support is HMAC (RFC 2104) included in IP security and SSL Requirements for HMAC
Use existing hash functions The hash function can be easily replaced by another one treat the hash function as a black box Preserve the performance of the hash function Use and handle keys in a simple way Well understood cryptographic analysis of the strength of the authentication mechanism
35
HMAC algorithm
Idea: append a secret key to the message and compute the hash value
To avoid a brute-force attack, apply the hash twice to mangle thoroughly the bits of the key with those of the message
H=embedded hash function IV=initial value to the has function M=message input to HMAC (including the padding specific to the hash function) Yi=i-th block of M L=number of blocks in M b=number of bit sin a block n=length of the hash code K=secret key, if its length is greater than b will be given as input to the hash function to produce n-bit key K+=K padded with 0 on the left to make a b-bit key, if the original length of K is smaller than b ipad=0x36 repeated b/8 times opad=0x5C repeated b/8 times
HMAC algorithm
H=embedded hash function IV=initial value input to hash function M=message input to HMAC (including the padding specific to the hash function) Yi= the i-th block of M L=number of blocks in M b=number of bits in a block n=length of hash code produced by the embedded hash function K=secret key, if its length is greater than b will be given as input to the hash function to produce n-bit key K+=K padded with 0 on the left to make a b-bit key, if the original length of K is smaller than b ipad=0x36 repeated b/8 times opad=0x5C repeated b/8 times HMACK(M)=H[ (K+ opad) || H[(K+ ipad) || M] ]
37
Strength of HMAC
Brute-force attack requires an effort on the level 2n-1 for a key of length n Birthday attack
The main idea in this attack is that Eve can compute the hash values of many messages and try to find a match In HMAC she is unable to do that because the hash is protected by a secret key Eve will have to rely on messages that she observes on the link: for MD5 she will have to wait in average for 264 messages generated using the same key
On a 1 Gbps-link she needs to observe a continuous stream of messages with no change in the key for about 250 000 years With SHA-1 280 messages are needed For HMAC, using MD5 is secure (and fast)
38