%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecture
%		date of the lecture
%		lecturer
%		scribe---that is you
%
\lecture{9}{October 2, 1997}{Ron Rivest}{Jesse Kornblum} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favorite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in Postscript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on Athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the Postscript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Topics
\begin{itemize}
\item Hashing in Digital Signatures
\item Hashing Security
\item MD5
\item Birthday Attacks
\item SHA
\item CvHP
\item MACs and Hashing
\end{itemize}

\section{Digital Signatures}

When messages get very long, encrypting them to use as a digital signature
with algorithms such as RSA can be very expensive. We'd like to sign our
messages with something much shorter, a ``fingerprint'' of the message,
also called a ``message digest.''

To create the fingerprint, we use a function (fingerprint function, 
MD-function, cryptographic hash function, etc.) that compresses messages
of arbitrary length into a preset set. This function, $h(x)$, normally
produces a fingerprint either 128 or 160 bits long. This shorter value is 
much easier to sign than the full message. Our goal is that:

\begin{itemize}
\item The function $h$ is efficient
\item The length of $h(x)$ is short
\item The function $h(x)$ is secure (i.e. it has strong collision-resistance,
defined below)
\end{itemize}

\section{Hashing Security}

The security of hash functions is measured by the existence of 
{\em collisions}. A collision is when two different messages produce the
same hash. (i.e. $h(m_{1}) = h(m_{2})$) 
Here are some terms used in describing the security hash functions:

{\bf Strong Collision-Resistance:} It is infeasible for an attacker to
find $x$ and $x^{\prime}$ forming a collision. (i.e. $h(x) = h(x^{\prime})$)

{\bf Weak Collision-Resistance:} Given an $x$ and $h(x)$, it is infeasible to
find $x^{\prime}$ such that $h(x) = h(x^{\prime})$. This implies that given
$h(x)$, it is infeasible to find any $x^{\prime}$ such that 
$h(x) = h(x^{\prime})$. (i.e. That $h$ is a one-way function.)

\section{Message Digest 5 (MD5)}

MD5 is a hashing function developed by Ron Rivest. A much more detailed
description can be found in handout 8
\footnote{Which actually comes from {\em Applied Cryptography} by B. Schneier}
or RFC 1321.

MD5 works by first padding the message until it is a multiple of 512 bits
long. Padding is done as follows:

\begin{enumerate}
\item Append a '1' bit to the message.
\item Append '0' bits until the message is 64 bits shorter than a 
multiple of 512 bits
\item Append a 64-bit representation of the message's original length
\end{enumerate}

The state of MD5 is kept in four 32-bit words, $A$, $B$, $C$, and $D$, all of
which are initialized to magic constant values.
MD5 processes the message in 512-bit blocks. As
we process the $i$th block of message, we update $A_{i-1}$, $B_{i-1}$, 
$C_{i-1}$, and $D_{i-1}$ to $A_{i}$, $B_{i}$, $C_{i}$, and $D_{i}$. The 
output of MD5, a 128 bit value, is the final state of $A$, $B$, $C$, and $D$ 
concatenated.

For each block of message, we have four rounds of updates. Each round
updates one of the four 32-bit words $A$, $B$, $C$, or $D$ four times.
(For a total of sixteen updates per block of message.)
Initially on each round, 
$A_{i} \leftarrow A_{i-1}$, $B_{i} \leftarrow B_{i-1}$, etc.
Each of the
updates is something similar to 
$A_{i} \leftarrow B_{i} + ((A_{i} + F(B_{i},C_{i},D_{i}) + M_{i} + T_{i} 
<<< s)$, where $F$ is a function,
\footnote{As an example, $F(a,b,c) = (a \wedge b) \vee (\bar{a} \wedge c)$}
$M_{i}$ is the $i$th block of the message,
and $T_{i}$ and $s$ are magic constants. (The symbol $<<<$ means ``rotate
left''.) At the end of each round, we finish
by updating all of the values one last time, namely:
$A_{i} \leftarrow A_{i} + A_{i-1}$, 
$B_{i} \leftarrow B_{i} + B_{i-1}$, etc.

\section{Secure Hash Algoritm (SHA)}

SHA is a hash function developed by the US government. It's similar to MD5, but
uses five 32-bit words and five rounds
per message block to produce a 160-bit hash, using linear transformations
of the message in each block.

\section{Birthday Attacks}

A birthday attack on a hash function attempts to use the birthday paradox
to find collisions in a hash function. (i.e. creating random messages,
taking their hash value, and checking if that hash value has been 
encountered before.) For MD5, as an example, an attacker
could expect to find collisions after trying $2^{64}$ messages. Given
today's computing power, this is a difficult, but not impossible problem.
Hence the move to stronger hashing algorithms, like SHA.

\section{CvHP}

Yet another hash function is CvHP. It's full name is the Chaum-vanHeijst-Pfitzmann 
hash function. First, we need to choose prime numbers $p$ and $q$ such that
$p = 2q + 1$. Next, we need an $\alpha$ and a $\beta$ that are both an
element of order $q$ (i.e. $\alpha^{q} \equiv 1 (\bmod p)$) and that
$\alpha \neq \beta$. For security, it must be 
difficult to compute $\log_{\alpha} \beta$.

The hash function splits the message into two parts $m_{1}$
and $m_{2}$. $h(m_{1},m_{2}) = \alpha^{m_{1}} * \beta^{m_{2}} (\bmod p)$.
It is necessary that $1 \leq |m_{1}| , |m_{2}| \leq q$.

The heart of CvHP is that it's infeasible to find $\alpha$ and $\beta$.
As an example, let's say that we have a collision:

\begin{center}
$\alpha^{m_{1}} * \beta^{m_{2}} = \alpha^{m_{3}} * \beta^{m_{4}} (\bmod p)$)
\end{center}

We can transform this to be 

\begin{center}
$\alpha^{m_{1} - m_{3}} = \beta^{m_{4} - m_{2}} (\bmod p)$
\end{center}

If we set $r = m_{1} - m_{3}$ and $s = m_{4} - m_{2}$, we get

\begin{center} 
$\alpha^{r} = \beta^{s} (\bmod p)$
\end{center}

If then we choose $t$ such that $t = s^{-1} (\bmod q)$, we can use 

\begin{center}
$\alpha^{rt} = \beta^{st} (\bmod p)$
\end{center}

to get $\alpha^{rt} = \beta (\bmod p)$. Since we said it's difficult to 
compute $log_{\alpha} \beta$, an attacker cannot get past this stage.

\section{MACs and Hash Functions}

A hash function can be used to produce a Message Authentication Code.
For example, a proposal by IBM for Internet messages is that a MAC
for each packet should be formed as follows:

$HMAC = MD5(k_{1},MD5(k_{2},M))$, where $k_{1}$ and $k_{2}$ are two
parts of a shared secret key.





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
