Insecure Hash Function

Loading...

En provenance du cours de University of Colorado System

Cryptographic Hash and Integrity Protection

20 notes

University of Colorado System

Cryptographic Hash and Integrity Protection

20 notes

Cours 4 sur 4 dans Specialization Applied Cryptography

Welcome to Cryptographic Hash and Integrity Protection! This course reviews cryptographic hash functions in general and their use in the forms of hash chain and hash tree (Merkle tree). Building on hash functions, the course describes message authentication focusing on message authentication code (MAC) based on symmetric keys. We then discuss digital signatures based on asymmetric cryptography, providing security properties such as non-repudiation which were unavailable in symmetric-cryptography-based message authentication. This course is a part of the Applied Cryptography specialization.

À partir de la leçon

Cryptographic Hash Function

Cryptographic hash function is a fundamental building block in modern cryptography and is used for digital signature, message authentication, anomaly detection, pseudo-random number generator, password security, and so on. This module define cryptographic hash functions and contrast it with ordinary hash functions. It also describes the iterative structure for hash implementation to support the hash requirements.

Hash Function0:55

Insecure Hash Function2:53

Rencontrer les enseignants

Sang-Yoon Chang
Assistant Professor
Computer Science

Now that we defined hash functions let's get some feel for

the security considerations when using them for cryptography.

One of the simplest hash function is the bit-by-bit exclusive or,

XOR, of every message input block.

This operation provides a bit parity for each position.

That is, it corresponds to the addition over modulo two

of the bits in the same position across the blocks.

If there are an odd number of ones then the parity bit will be one and

if there are even number of ones then the parity bit will be zero.

Such function can be used as a checksum for

data integrity especially if the message or the inputs are random.

For example, given that each end bit hash value is equally likely,

the probability that a data error and

the change in the message blocks will result in the same hash value as

the original without the error is two to the minus nth power, two raised to

the power of minus n which corresponds to the probability of the detection failure.

The function is less effective with data formatted in a certain manner.

For example, in most text files the high order bits are more likely zero than ones.

Also the header packets during transmission may also have fixed patterns.

These types of regularity can affect the distribution of the outputs and

make them non uniform.

A simple way to improve the distribution is to perform circular shifts or

rotations on the message blocks before the XOR processing.

For example, if the cyclic shift amount is one,

the first block will be shifted by one, the second block by two,

the third block shifted by three bits and so on, before they get processed by XOR.

Even though this improved algorithm provides better distribution,

hiding the regularity of the message, the data, and can be used for

data integrity, such algorithm becomes problematic for

data security when an encrypted hash code is used with a plain text message.

Given a message, it is easy for

an attacker to produce a new message that yields the same hash code.

This can be done by the attacker by simply taking the new message and

appending a block crafted by the attacker so

that the message plus the block yields the desired hash code.

In other words, it is easy for an attacker to generate collisions which can help in

the attacker generating new packets that will bypass the data integrity protection.

Explorer notre catalogue

Rejoignez-nous gratuitement et obtenez des recommendations, des mises à jour et des offres personnalisées.

Coursera propose un accès universel à la meilleure formation au monde, en partenariat avec des universités et des organisations du plus haut niveau, pour proposer des cours en ligne.

© 2019 Coursera Inc. Tous droits réservés.

Télécharger dans l'App Store

Disponible sur Google Play