SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Collision-Resistant Hash Functions: Foundations and Practical Applications

rigg avatar
rigg
18 diapositives · 333 Views · Aug 25, 2014

This text explores the concept of collision-resistant hash functions as detailed by Jonathan Katz and Yehuda Lindell in their work on modern cryptography. It provides a foundational understanding of what constitutes a collision in a hash function, the definitions of collision resistance, pre-image resistance, and second pre-image resistance. The text also introduces the Merkle-Damgård transform as a method for constructing collision-resistant hash functions and discusses the HMAC (Hashed Message Authentication Code) as a practical implementation for ensuring message authenticity and integrity.

#collision-resistant hash functions: foundations and practical applications #collision-resistant hash functions: foundations and practical applications ppt #powerpoint #presentation
Collision-Resistant Hash Functions: Foundations and Practical Applications - slide 1
01 / 18Collision-Resistant Hash Functions: Foundations and Practical Applications
1 / 17

Télécharger la présentation

Collision-Resistant Hash Functions: Foundations and Practical Applications
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. CIS 5371 Cryptography 4.Collision Resistant Hash Functions Based on: Jonathan Katz and Yehuda LindellIntroduction to Modern Cryptography

  2. Collision Resistance A collision in a function H is a pair of distinct inputs x, x’ Collision resistance is trivial to achieve if compression is not required (take for example the identity function) We shall be dealing with a family of hash functions indexed by a key s. That is H will take as input a key s and a string x and output a string:

  3. Definition 4.11, Hash Function A hash function is a pair of probabilistic polynomial-time algorithms such that: • takes input the security parameter and outputs a key . • There is a polynomial such that takes as input a key and a stringand .

  4. A collision finding experiment -(A,)

  5. Definition 4.12 Collision Resistant Hash Function A hash function is collision resistant, if for all probabilistic polynomial-time adversaries there is a function such that: -

  6. Weaker notions of security for Hash Functions • Collision resistance.The strongest notion, as defined earlier. • Second pre-image resistance.Informally, given a key and a string it is infeasible for a probabilistic polynomial-time adversary to find such that • Pre-image resistance Informally, given a key and a string (but not) for a randomly chosen it is infeasible for a probabilistic polynomial-time adversary to find such that

  7. Weaker notions of security for Hash Functions • Collision resistance Second pre-image resistance If given the adversary can find such that pair with • Second pre-image resistancePre-image resistanceIf it were possible to invert and find an such that , then it would be possible to take a given input, compute, and then invert to find such that

  8. Generic birthday attack Birthday problem Let be a hash function . • Assume that the values are uniformlydistributed in and independent . • Assume that arbitrary inputs are selected. Then the probability that there is a collision using hash evaluations is greater that ½. The time taken is . (One has to sort outputs---assume that one can evaluate a hash function in constant time.)

  9. Improved birthday attack Memory is a scarcer resource than time: storing hash evaluations is costly.

  10. Improved birthday attack Improved birthday attack Let be a hash function. Select. For • Compute and . • If there is a collusion; else continue. It can be shown that we get a collision with probability roughly ½ in steps.

  11. Construction 4.12 The Merkle-Damgård transform is a fixed-length collision-resistant hash function with inputs of length and outputs . A variable-length hash function is constructed as follows. • : on input , output key . • H : on inputand, do: • Set , pad so that it can be parsed into blocks of length . Set ( bits). • Set . • For , compute ). • Output

  12. The Merkle-Damgåard transform . . . =IV =

  13. Theorem 4.14 If is a fixed-length collision-resistant hash function then is a collision-resistant hash function.

  14. HMAC – A keyed MAC -Notation Assume that: • are fixed non-secret keys of length • is a secret key of length • is a compression function that compresses its input by half. • Reminder: is a family of functions indexed by a non-secret key that on input outputs astring ). • the hash function constructed by using the Merkle-Damgrd transform applied to . • is the length of the output of .

  15. HMAC – A keyed MAC -Notation Define: • , and • to be the corresponding Merkle-Damgård transform.

  16. Construction 4.17 HMAC Let be a fixed-length collision-resistant hash function, and let be the result of applying the Merkle-Damgard transformation to . Let , and be fixed constants of length . HMAC defines a MAC as follows: • : on input , run to get key . Also choose at random. Output the key (). • Mac: on input a key and message of length output the tag: • Verfy: on input a keya message , and tag output 1 if and only if

  17. HMAC . . . byte x repeated bytexrepeated 

  18. Theorem 4.14 If is collision-resistant and G is a pseudorandom generator then HMAC is existentially unforgeable under adaptive chosen message attacks (for arbitrary length messages).