%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{10}{October 7, 1997}{Ron Rivest}{Edmond Kayi Lee} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favorite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Topics Covered}
\begin{itemize}
\item One-way Hash Functions and Applications
\item Randomized Hash Functions
\item Auction and Commitment
\end{itemize}

\section{Review: CvHP}
CvHP stands for Chaum-vanHeijst-Pfitzmann. It is a one-way hash function 
which is based on the assumption of that solving the discrete-log problem is difficult. 

We pick primes $p, q$ such that $p=2q+1$.
% For example, we can let $p=11$ and $q=5$.
%In this case 2 is a generator of $Z_{11}^*$.
Let $G_q$ be a subgroup of $Z_p^*$ 
such that $x\in G_q \leftrightarrow x^q\equiv 1\pmod p$. 

\begin{theorem}
$x^q\equiv 1\pmod p$ if and only if $x$ is a square. Thus, $x\in G_q$ if and only if  $x$ is a square.  
\end{theorem}

\begin{proof}
Let $x=g^{2k+i}$ for some generator $g$ of $Z_p^*$, where $k\in\{0,1,\ldots,q\}, i\in\{0,1\}$.

\[
\begin{array}{rl}
x^q&\equiv (g^{2k+i})^q\pmod p\\
&\equiv (g^{2q})^kg^{qi} \pmod p\\
&\equiv (g^{p-1})^kg^{qi} \pmod p\\
&\equiv g^{qi} \pmod p
\end{array}
\]

If $x$ is a square, $i=0$. Therefore $g^{qi}=1$. If $x$ is not a square, $i=1$. And $g^{qi}=g^q\neq 1$, since $g$ is a generator.
\end{proof}   
 
Therefore, we can pick two elements $\alpha, \beta\in G_q$ by simply choosing any element in $Z_p^*$ and squaring it. Alternatively, we can find a generator $g$ of $Z_p^*$ and get a even power of $g$ modulo $p$.

Now assume we get $\alpha, \beta \neq 1$ such that it is presumed hard to compute $\log_{\alpha} \beta$, the message $x=x_1, x_2$ is hashed as
$h(x_1,x_2)=\alpha^{x_1}\beta^{x_2}$ mod $p$. 

Here $p, \alpha$ and $\beta$ is public, nothing is secret. So everybody can create a message digest or verify a message digest. As opposed to MAC or Digital Signature, it cannot be used for authentication. In summary:\\

\begin{tabular}{||c|c|c||}\hline
&Who can verify&Who can create\\\hline\hline
One-way Function&Anyone&Anyone\\\hline
MAC& Shared secret key holders only&Shared secret key holders only\\\hline
Digital Signature&Anyone&Private key holder only\\\hline
\end{tabular}

\section{Applications of One-way Hash Functions}
\begin{itemize}
\item Virus Checking
\begin{itemize}
\item virus modifies file contents
\item producer makes checksum $c=h(F)$ where $F$ is the original file content and $h$ is a weakly collision-free one-way hash function
\item $c$ is distributed to users via secure channels (e.g. floppy disk, CD)  
\item users compare $c$ with $h(F')$, where $F'$ is the suspected copy of the file
\end{itemize}
\item Software/Public Key Distribution
\begin{itemize}
\item objective: get the ``true'' copy of software or public key
\item same idea as virus checking
\item obtain a hash value of the software/public key via a secure channel and compare it to the hash value of user's copy. 
\end{itemize}
\item Swapping to insecure storage
\begin{itemize}
\item keep a table of hash values of the pages before swapping them out to an insecure storage
\item check the hash value of the page when retrieved back next time
\end{itemize}
\item Secure Reference or Pointer
\begin{itemize}
\item used as web page reference
\item URLs are hashed
\end{itemize}
\item Time stamp
\begin{itemize}
\item files or documents are hashed and then time-stamped by some time-stamping services
\end{itemize}
\item One-time Password (S-Key)
\begin{itemize}
\item pick a seed $x_0$ to create a chain of hash values: $x_0\stackrel{h(x_0)}\longrightarrow x_1\stackrel{h(x_1)}\longrightarrow x_2\cdots\stackrel{h(x_{n})}\longrightarrow x_{n}$
\item originally system stores $x_n$, user enters password $x_{n-1}$
\item system verifies $h(x_{n-1})\stackrel{?}=x_n$
\item adversaries cannot find $x_{n-1}$ even if knowing $x_n$, since $h$ is weakly collision-free
\item system then stores $h_{n-1}$, next time user enters $h_{n-2}$ as password
\end{itemize}

\end{itemize}

\section{Randomized Hash Functions}
Sometimes we are concerned about whether $h(x)$ reveals any information of $x$ for a
one-way hash function $h$. For example, in a multi-user system, users' passwords are 
usually hashed by a certain hash function and stored in a password file. Is it totally safe then?

Adversaries may get their way to the password file and read the list of the hashed passwords. It is common (though strongly discouraged) that English words are used as passwords. As a result, adversaries can create a table of hash values for all the dictionary words in advance and look up the hashed passwords in the table. This is known as the {\it dictionary attack}.

Also, if two people have the same password, the adversary knows that, since the hash
function is deterministic. 

As a solution, we introduce random factors. To do this, every time a user password is created, a random number $r$ (called a {\it salt}) is picked and hashed with the password. The random number $r$ is kept for verification. Now the adversary only sees a ``random'' number.

e.g. $h(x)=(r, MD5(r,x))$ or $h(x)=(r,r^{MD5(x)})$

In this case, the adversary needs to generate a separate dictionary hash table for each random number (i.e. user password). Same passwords are very unlikely to give the same hash values because of the salt.
 
\section{Application: Auction \& Commitment}
Imagine we are designing a computer system for secure auction. The auction works this way:
\begin{enumerate}
\item bidders submit ``sealed'' bids
\item auction over
\item bidders ``open'' bids, auctioneer announces the winning bid
\end{enumerate}

All bidders do not want the auctioneer and other people know what their bids are. On the other hand, the auctioneer needs to prevent the bidders from changing their bids once they have submitted. Such a scenario is called {\it commitment}. 

To keep confidentiality, bidders need to somehow encrypt their bids before submitting to the auctioneer and keep the key until the auction is over. To avoid changing bids, the auctioneer has to prevent the bidders from changing their keys because changing the keys essentially changes the bids as well. 

One solution may come. The auctioneer chooses a public, randomized, weakly collision-free, one-way hash function $h$. And each bidder picks a random salt $r$ for himself and makes his bid $b$. Bidders submit $h(r,b)$ to the auctioneer. At the end, bidders open their bids by disclosing $r$ and $b$. 

In this way, the auctioneer cannot get any information of the bids because the submitted hash values are randomized. On the other hand, bidders cannot change their bids because it is hard to compute another pair $(r',b')$ such that $h(r',b')=h(r,b)$. 

One example of the hash functions that can be used is the randomized CvHP. The auctioneer picks $p, \alpha$ and $\beta$ and bidders choose their own random salt $r$ and their bids $b$. Bidders submit $\alpha^r\beta^b$ modulo $p$ to the auctioneer. At the end of the auction, the bidders disclose $r$ and $b$ and the auctioneer verifies that $\alpha^r\beta^b$ modulo $p$ is the submitted value. 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
