# Hash Functions

#### Multiple Signatures

- Could we simply split up a message and sign parts?

![1649192960.png](img/1649192960.png)

A lot of faff for signing large files

- An attacker can remove $s_{n-1}$ (or $s_{any}$) and it would still be valid

### Properties of Hash Functions

1. Any input length
2. Fixed output length
3. Pre-image resistance (one way)
4. Second pre-image resistance
    - If we have a hashed message, we cannot find another message with the same hash
5. Collision resistance

#### Pre-image Resistance

- Hash functions must be one-way
- Given a hash of a message $H(x)$ it must be infeasible to calculate $x$
- Less applicable to digital signatures
    - Crucial to password storage and key derivation

#### Second Pre-image Resistance

- Weak collision resistance
- Given a message $x_1$ and a hash of that message $H(x_1)$ it should be infeasible to find a second message $x_2$ such that $H(x_1)=H(x_2)$

![1649193613.png](img/1649193613.png)

##### Second pre-image attack

![1649193645.png](img/1649193645.png)

Oscar finds a weak message (one of the messages is known ahead of time); he replaces the message $x_1$ with $x_2$. Now Oscar can send a signed message to Alice

#### Collision Resistance

- Strong collision resistance
- It is not possible to find **any** message pair $x_1, x_2$ such that $H(x_1)=H(x_2)$
- In practice, this is *much easier than finding a weak collision*

![1649193812.png](img/1649193812.png)

### Preventing Collisions

![1649193848.png](img/1649193848.png)

#### Collision Attack

![1649193973.png](img/1649193973.png)

##### How Likely

**Second pre-image attacks**

- For a 256 bit hash with good random properties we might expect $2^{256}$ bit brute force before we find a collision with $x_1$

**Collision Attacks**

- There are many other possible collisions beyond those simply with $x_1$

### The Birthday Paradox

> What is the probability two people in this room share a birthday

- It is easier to first calculate the probability $P(n)$ that $n$ people do not share any birthdays:

$$
\begin{align*}
P(2)&=(1-\frac{1}{365}) \\
P(3)&=(1-\frac{1}{365})\cdot (1-\frac{2}{365}) \\
P(n)&=(1-\frac{1}{365})\cdot (1-\frac{2}{365})\dots (1-\frac{n-1}{365})
\end{align*}
$$

- The probability of at least one collision is $1 – P(\textrm{no collision})$.
    - The probability of a collision with only 23 people is ~50%!
    - For 40 people it’s ~90%
- The same principle applies to hash functions, the more hashes computed, the more likely a collision becomes

![1649194470.png](img/1649194470.png)

#### The Birthday Attack

- The output of the hash must be long enough to avoid a birthday attack
- Given a hash function outputs $n$ bit hashes
- You will find a collision after approx $\sqrt{(2^n)}=2^{\frac n2}$ random attempts
- This means that your bit length needs to be double the size of your desired security margin
- `SHA-256` therefore offers equivalent security to `AES 128`
- left at `25:55`