96 lines
2.9 KiB
Markdown
96 lines
2.9 KiB
Markdown
# Hash Functions
|
||
|
||
#### Multiple Signatures
|
||
|
||
- Could we simply split up a message and sign parts?
|
||
|
||
\
|
||
|
||
A lot of faff for signing large files
|
||
|
||
- An attacker can remove $s_{n-1}$ (or $s_{any}$) and it would still be valid
|
||
|
||
### Properties of Hash Functions
|
||
|
||
1. Any input length
|
||
2. Fixed output length
|
||
3. Pre-image resistance (one way)
|
||
4. Second pre-image resistance
|
||
- If we have a hashed message, we cannot find another message with the same hash
|
||
5. Collision resistance
|
||
|
||
#### Pre-image Resistance
|
||
|
||
- Hash functions must be one-way
|
||
- Given a hash of a message $H(x)$ it must be infeasible to calculate $x$
|
||
- Less applicable to digital signatures
|
||
- Crucial to password storage and key derivation
|
||
|
||
#### Second Pre-image Resistance
|
||
|
||
- Weak collision resistance
|
||
- Given a message $x_1$ and a hash of that message $H(x_1)$ it should be infeasible to find a second message $x_2$ such that $H(x_1)=H(x_2)$
|
||
|
||
|
||
|
||
##### Second pre-image attack
|
||
|
||
|
||
|
||
Oscar finds a weak message (one of the messages is known ahead of time), he replaces the message $x_1$ with $x_2$. Now Oscar can send a signed message to Alice
|
||
|
||
#### Collision Resistance
|
||
|
||
- Strong collision resistance
|
||
- It is not possible to find **any** message pair $x_1, x_2$ such that $H(x_1)=H(x_2)$
|
||
- In practice, this is *much easier than finding a weak collision*
|
||
|
||
|
||
|
||
### Preventing Collisions
|
||
|
||
|
||
|
||
#### Collision Attack
|
||
|
||
|
||
|
||
##### How Likely
|
||
|
||
**Second pre-image attacks**
|
||
|
||
- For a 256 bit hash with good random properties we might expect $2^{256}$ bit brute force before we find a collision with $x_1$
|
||
|
||
**Collision Attacks**
|
||
|
||
- There are many other possible collisions beyond those simply with $x_1$
|
||
|
||
### The Birthday Paradox
|
||
|
||
> What is the probability two people in this room share a birthday
|
||
|
||
- It is easier to first calculate the probability $P(n)$ that $n$ people do not share any birthdays:
|
||
|
||
$$
|
||
\begin{align*}
|
||
P(2)&=(1-\frac{1}{365}) \\
|
||
P(3)&=(1-\frac{1}{365})\cdot (1-\frac{2}{365}) \\
|
||
P(n)&=(1-\frac{1}{365})\cdot (1-\frac{2}{365})\dots (1-\frac{n-1}{365})
|
||
\end{align*}
|
||
$$
|
||
|
||
- The probability of at least one collision is $1 – P(\textrm{no collision})$.
|
||
- The probability of a collision with only 23 people is ~50%!
|
||
- For 40 people it’s ~90%
|
||
- The same principle applies to hash functions, the more hashes computed, the more likely a collision becomes
|
||
|
||
|
||
|
||
#### The Birthday Attack
|
||
|
||
- The output of the hash must be long enough to avoid a birthday attack
|
||
- Given a hash function outputs $n$ bit hashes
|
||
- You will find a collision after approx $\sqrt{(2^n)}=2^{\frac n2}$ random attempts
|
||
- This means that your bit length needs to be double the size of your desired security margin
|
||
- `SHA-256` therefore offers equivalent security to `AES 128`
|
||
- left at `25:55` |