Hash Functions

Multiple Signatures

Could we simply split up a message and sign parts?

A lot of faff for signing large files

An attacker can remove s_{n-1} (or s_{any}) and it would still be valid

Properties of Hash Functions

Any input length
Fixed output length
Pre-image resistance (one way)
Second pre-image resistance
- If we have a hashed message, we cannot find another message with the same hash
Collision resistance

Pre-image Resistance

Hash functions must be one-way
Given a hash of a message H(x) it must be infeasible to calculate x
Less applicable to digital signatures
- Crucial to password storage and key derivation

Second Pre-image Resistance

Weak collision resistance
Given a message x_1 and a hash of that message H(x_1) it should be infeasible to find a second message x_2 such that H(x_1)=H(x_2)

Second pre-image attack

Oscar finds a weak message (one of the messages is known ahead of time); he replaces the message x_1 with x_2. Now Oscar can send a signed message to Alice

Collision Resistance

Strong collision resistance
It is not possible to find any message pair x_1, x_2 such that H(x_1)=H(x_2)
In practice, this is much easier than finding a weak collision

Preventing Collisions

Collision Attack

How Likely

Second pre-image attacks

For a 256 bit hash with good random properties we might expect 2^{256} bit brute force before we find a collision with x_1

Collision Attacks

There are many other possible collisions beyond those simply with x_1

The Birthday Paradox

What is the probability two people in this room share a birthday

It is easier to first calculate the probability P(n) that n people do not share any birthdays:


\begin{align*}
P(2)&=(1-\frac{1}{365}) \\
P(3)&=(1-\frac{1}{365})\cdot (1-\frac{2}{365}) \\
P(n)&=(1-\frac{1}{365})\cdot (1-\frac{2}{365})\dots (1-\frac{n-1}{365})
\end{align*}

The probability of at least one collision is 1 – P(\textrm{no collision}).
- The probability of a collision with only 23 people is ~50%!
- For 40 people it’s ~90%
The same principle applies to hash functions, the more hashes computed, the more likely a collision becomes

The Birthday Attack

The output of the hash must be long enough to avoid a birthday attack
Given a hash function outputs n bit hashes
You will find a collision after approx \sqrt{(2^n)}=2^{\frac n2} random attempts
This means that your bit length needs to be double the size of your desired security margin
SHA-256 therefore offers equivalent security to AES 128
left at 25:55

2.9 KiB Raw Blame History Unescape Escape