Hash and MAC Algorithms

1
 Hash and MAC Algorithms
• Hash Functions
– condense arbitrary size message to fixed size
– by processing message in blocks
– through some compression function
– either custom or block cipher based
• Message Authentication Code (MAC)
– fixed sized authenticator for some message
– to provide authentication for message
– by using block cipher mode or hash function
Hash Algorithm Structure
 Secure Hash Algorithm
• SHA originally designed by NIST (National Institute of
Standards and Technology)
• was revised in 1995 as SHA-1
• US standard for use with DSA signature scheme
– standard is FIPS 180-1 1995, also Internet RFC3174
– the algorithm is SHA, the standard is SHS
• based on design of MD4 with key differences
• produces 160-bit hash values
• recent 2005 results on security of SHA-1 have raised concerns
on its use in future applications
 Revised Secure Hash Standard
• NIST issued revision FIPS 180-2 in 2002
• adds 3 additional versions of SHA
– SHA-256, SHA-384, SHA-512
• designed for compatibility with increased security
provided by the AES cipher
• structure & detail is similar to SHA-1
• hence analysis should be similar
• but security levels are rather higher
Comparison of SHA Parameters
SHA-512 Overview
 SHA-512
• Step 1: Append padding bits
• (length=896(mod 1024))
• Step 2: Append length
• Step 3: Initialize hash buffer
• Step 4: Process the message in 1024-bit
• (128-word (Wo =64 bits)) blocks, which
forms the heart of the algorithm
• Step 5: Output the final state value as the
resulting hash
8
 SHA-512
• Step 3: Initialize hash buffer
• a=6A09E667F3BCC908
• b=BB67AE8584CAA73B
• c=3C6EF372FE94F82B
• d=A54FF53A5F1D36F1
• e=510E527FADE682D1
• f=9B05688C2B3F6C1F
• g=1F83D9ABFB41BD6B
• h=5BE0CDI9137E2179
Taking first 64 bits of the fractional parts of the square roots
of the first eight prime no. 9
SHA-512 Overview
 SHA-512 Compression Function
• heart of the algorithm
• processing message in 1024-bit blocks
• consists of 80 rounds
– updating a 512-bit buffer
– using a 64-bit value Wt derived from the current
message block
– and a round constant based on cube root of first 80
prime numbers
12
SHA-512 Round Function
 Function Elements
• Ch(e,f,g) = (e AND f) XOR (NOT e AND g)
• Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c)
• ∑(a) = ROTR(a,28) XOR ROTR(a,34) XOR
ROTR(a,39)
• ∑(e) = ROTR(e,14) XOR ROTR(e,18) XOR
ROTR(e,41)
• + = addition modulo 2^64
– Kt = a 64-bit additive constant
– Wt = a 64-bit word derived from the current 512-
bit input block.
16
 SHA-512 Round Function

Wo = 64 bits
(64*16 (Wo to W15) = 1024)
 Keyed Hash Functions as MACs
• want a MAC based on a hash function
– because hash functions are generally faster
– code for crypto hash functions widely available
• hash includes a key along with message
• original proposal:
KeyedHash = Hash(Key|Message)
– some weaknesses were found with this
• eventually led to development of HMAC
 HMAC
• specified as Internet standard RFC2104
• uses hash function on the message:
HMACK = Hash[(K+ XOR opad) ||
Hash[(K+ XOR ipad)||M)]]
• where K+ is the key padded out to size
• and opad, ipad are specified padding constants
• overhead is just 3 more hash calculations than the
message needs alone
• any hash function can be used
– eg. MD5, SHA-1, RIPEMD-160, Whirlpool
 HMAC
H = embedded hash function (e.g., MD5, SHA-1, RIPEMD-160)
IV = initial value input to hash function
M = message input to HMAC (including the padding specified in
the embed-
ded hash function)
Yi = i th block of M, 0 <= i <= (L – 1)
L = number of blocks in M
b = number of bits in a block
n = length of hash code produced by embedded hash function
 HMAC
• K = secret key; recommended length is >= n; if key length is
greater than b, the key is input to the hash function to produce
an n-bit key
• K+ = K padded with zeros on the left so that the result is b bits
in length
• ipad = 00110110 (36 in hexadecimal) repeated b/8 times
• opad = 01011100 (5C in hexadecimal) repeated b/8 times
• Then HMAC can be expressed as
HMAC(K, M) =
H[(K+ Γ opad) || H[(K + Γ ipad) || M]]
HMAC Overview