Hashes and Message Digest

1
Hashes and Message Digest

• Hash is also called message digest
• One-way function dh(m) but no h(d)m
• Cannot find the message given a digest
• Cannot find m1, m2, where d1d2
• Arbitrary-length message to fixed-length digest
• Randomness
• any bit in the outputs 1 half the time
• each output 50 1 bits

2
Birthday Problem

• How many people do you need so that the
  probability of having two of them share the same
  birthday is 50 ?
• Random sample of n birthdays (input) taken from k
  (365, output)
• kn total number of possibilities
• (k)nk(k-1)(k-n1) possibilities without
  duplicate birthday
• Probability of no repetition
• p (k)n/kn ? 1 - n(n-1)/2k
• For k366, minimum n 23
• n(n-1)/2 pairs, each pair has a probability 1/k
  of having the same output
• n(n-1)/2k 50 ? nk1/2

3
How Many Bits for Hash?

• m bits, takes 2m/2 to find two with the same hash
• 64 bits, takes 232 messages to search (doable)
• Need at least 128 bits

4
Using Hash for Authentication

• Alice to Bob challenge rA
• Bob to Alice MD(KABrA)
• Bob to Alice rB
• Alice to Bob MD(KABrB)
• Only need to compare MD results

5
Using Hash to Encrypt

• One-time pad with KAB
• Compute bit streams using MD, and K
• b1MD(KAB), biMD(KABbi-1),
• ? with message blocks
• Add a random 64 bit number (aka IV)
  b1MD(KABIV), biMD(KABbi-1),

6
General Structure of Secure Hash Code

• Iterative compression function
• Each f is collision-resistant, so is the
  resulting hashing

7
MD5 Message Digest Version 5
input Message
Output 128 bits Digest

• Until recently the most widely used hash
  algorithm
• in recent times have both brute-force
  cryptanalytic concerns
• Specified as Internet standard RFC1321

8
MD5 Overview
9
MD5 Overview

• Pad message so its length is 448 mod 512
• Append a 64-bit original length value to message
• Initialise 4-word (128-bit) MD buffer (A,B,C,D)
• Process message in 16-word (512-bit) blocks
• Using 4 rounds of 128 bit operations on message
  block buffer
• Add output to buffer input to form new buffer
  value
• Output hash value is the final buffer value

10
Padding Twist

• Given original message M, add padding bits 10
  such that resulting length is 64 bits less than a
  multiple of 512 bits.
• Append (original length in bits mod 264),
  represented in 64 bits to the padded message
• Final message is chopped 512 bits a block

11
MD5 Process

• As many stages as the number of 512-bit blocks in
  the final padded message
• Digest 4 32-bit words MDABCD
• Every message block contains 16 32-bit words
  m0m1m2m15
• Digest MD0 initialized to A01234567,B89abcdef,C
  fedcba98, D76543210
• Every stage consists of 4 passes/rounds over the
  message block, each modifying MD
• Each block 4 rounds, each round 16 passes

12
Processing of Block mi - 4 Passes
mi
MDi
ABCDfF(ABCD,mi,T1..16)
A
C
D
B
ABCDfG(ABCD,mi,T17..32)
ABCDfH(ABCD,mi,T33..48)
ABCDfI(ABCD,mi,T49..64)




MD i1
13
Each Block Has 4 Rounds and 64 Steps

• Each step t (0
• Input
• mt a 32-bit word from the message
• With different shift every round
• Tt int(232 abs(sin(i))), 0
• Provided a randomized set of 32-bit patterns,
  which eliminate any regularities in the input
  data
• ABCD current MD
• Output
• ABCD new MD

14
MD5 Compression Function
15
Secure Hash Algorithm

• Developed by NIST, specified in the Secure Hash
  Standard (SHS, FIPS Pub 180), 1993
• SHA is specified as the hash algorithm in the
  Digital Signature Standard (DSS), NIST

16
General Logic

• Input message must be
• not really a problem
• Message is processed in 512-bit blocks
  sequentially
• Message digest is 160 bits
• SHA design is similar to MD5, but a lot stronger

17
Basic Steps

• Step1 Padding
• Step2 Appending length as 64 bit unsigned
• Step3 Initialize MD buffer 5 32-bit words
• Store in big endian format, most significant bit
  in low address
• ABCDE
• A 67452301
• B efcdab89
• C 98badcfe
• D 10325476
• E c3d2e1f0

18
Basic Steps...

• Step 4 the 80-step processing of 512-bit blocks
  4 rounds, 20 steps each.
• Each step t (0
• Input
• Wt a 32-bit word from the message
• Kt a constant.
• ABCDE current MD.
• Output
• ABCDE new MD.

19
SHA-1 verses MD5

• Brute force attack is harder (160 vs 128 bits for
  MD5)
• Not vulnerable to any known cryptanalytic attacks
  (compared to MD4/5)
• A little slower than MD5 (80 vs 64 steps)
• Both work well on a 32-bit architecture
• Both designed as simple and compact for
  implementation

20
Revised Secure Hash Standard

• NIST have issued a revision FIPS 180-2
• adds 3 additional hash algorithms
• SHA-256, SHA-384, SHA-512
• designed for compatibility with increased
  security provided by the AES cipher
• structure detail is similar to SHA-1
• hence analysis should be similar

21
Outline

• User authentication
• Password authentication, salt
• Challenge-Response
• Biometrics
• Token-based authentication
• Authentication in distributed systems (multi
  service providers/domains)
• Single sign-on, Microsoft Passport
• Trusted Intermediaries

22
Password authentication

• Basic idea
• User has a secret password
• System checks password to authenticate user
• Issues
• How is password stored?
• How does system check password?
• How easy is it to guess a password?
• Difficult to keep password file secret, so best
  if it is hard to guess password even if you have
  the password file

23
Basic password scheme

• Password file

User
kiwifruit
exrygbzyf kgnosfix ggjoklbsz
hash function
24
Basic password scheme

• Hash function h strings ? strings
• Given h(password), hard to find password
• No known algorithm better than trial and error
• User password stored as h(password)
• When user enters password
• System computes h(password)
• Compares with entry in password file
• No passwords stored on disk

25
Unix password system

• Hash function is 25xDES
• 25 rounds of DES-variant encryptions
• Password file is publicly readable
• Other information in password file
• Any user can try dictionary attack
• User looks at password file
• Computes hash(word) for every word in dictionary
• Salt makes dictionary attack harder

R.H. Morris and K. Thompson, Password security a
case history, Communications of the ACM,
November 1979
26
Salt

• Password line
• waltfURfuu4.4hY0U129129Belgers/home/walt/bin
  /csh

Compare
Salt
Input
Key
Constant, A 64-bit block of 0
Ciphertext
25x DES
Plaintext
When password is set, salt is chosen
randomly 12-bit salt slows dictionary attack by
factor of 212
27
Dictionary Attack some numbers

• Typical password dictionary
• 1,000,000 entries of common passwords
• people's names, common pet names, and ordinary
  words.
• Suppose you generate and analyze 10 guesses per
  second
• This may be reasonable for a web site offline is
  much faster
• Dictionary attack in at most 100,000 seconds 28
  hours, or 14 hours on average
• If passwords were random
• Assume six-character password
• Upper- and lowercase letters, digits, 32
  punctuation characters
• 689,869,781,056 password combinations.
• Exhaustive search requires 1,093 years on average

28
Challenge-response Authentication

• Goal Bob wants Alice to prove her identity to
  him

Protocol ap1.0 Alice says I am Alice
I am Alice
Failure scenario??
29
Authentication

• Goal Bob wants Alice to prove her identity to
  him

Protocol ap1.0 Alice says I am Alice
in a network, Bob can not see Alice, so Trudy
simply declares herself to be Alice
I am Alice
30
Authentication another try
Protocol ap2.0 Alice says I am Alice in an IP
packet containing her source IP address
Failure scenario??
31
Authentication another try
Protocol ap2.0 Alice says I am Alice in an IP
packet containing her source IP address
Trudy can create a packet spoofing Alices
address
32
Authentication another try
Protocol ap3.0 Alice says I am Alice and sends
her secret password to prove it.
Failure scenario??
33
Authentication another try
Protocol ap3.0 Alice says I am Alice and sends
her secret password to prove it.
Alices password
Alices IP addr
Im Alice
playback attack Trudy records Alices packet and
later plays it back to Bob
34
Authentication yet another try
Protocol ap3.1 Alice says I am Alice and sends
her encrypted secret password to prove it.
Failure scenario??
35
Authentication another try
Protocol ap3.1 Alice says I am Alice and sends
her encrypted secret password to prove it.
encryppted password
Alices IP addr
record and playback still works!
Im Alice
36
Authentication yet another try
Goal avoid playback attack
Nonce number (R) used only once in-a-lifetime
ap4.0 to prove Alice live, Bob sends Alice
nonce, R. Alice must return R, encrypted with
shared secret key
I am Alice
R
Alice is live, and only Alice knows key to
encrypt nonce, so it must be Alice!
Failures, drawbacks?
37
Authentication ap5.0

• ap4.0 doesnt protect against server database
  reading
• can we authenticate using public key techniques?
• ap5.0 use nonce, public key cryptography

I am Alice
Bob computes
R
and knows only Alice could have the private key,
that encrypted R such that
38
Biometrics

• Use a persons physical characteristics
• fingerprint, voice, face, keyboard timing,
• Advantages
• Cannot be disclosed, lost, forgotten
• Disadvantages
• Cost, installation, maintenance
• Reliability of comparison algorithms
• False positive Allow access to unauthorized
  person
• False negative Disallow access to authorized
  person
• Privacy?
• If forged, how do you revoke?

39
Biometrics

• Common uses
• Specialized situations, physical security
• Combine
• Multiple biometrics
• Biometric and PIN
• Biometric and token

40
Token-based authenticationSmart Card

• With embedded CPU and memory
• Various forms
• PIN protected memory card
• Enter PIN to get the password
• Cryptographic challenge/response cards
• A cryptographic key in memory
• Computer create a random challenge
• Enter PIN to encrypt/decrypt the challenge w/ the
  card

41
Smart Card Example
Initial data
Challenge
Time
Time
function

• Some complications
• Initial data shared with server
• Need to set this up securely
• Shared database for many sites
• Clock skew

42
Outline

• User authentication
• Password authentication, salt
• Challenge-Response
• Biometrics
• Token-based authentication
• Authentication in distributed systems
• Single sign-on, Microsoft Passport
• Trusted Intermediaries

43
Single sign-on systems
e.g. Securant, Netegrity, Oblix
LAN
Rules
Database
user name, password, other auth
Authentication
Application
Server

• Advantages
• User signs on once
• No need for authentication at multiple sites,
  applications
• Can set central authorization policy for the
  enterprise

44
Microsoft Passport

• Launched 1999
• Claim 200 million accounts in 2002
• Over 3.5 billion authentications each month
• Log in to many websites using one account
• Used by MS services Hotmail, MSN Messenger or MSN
  subscriptions also Radio Shack, etc.
• Hotmail or MSN users automatically have Microsoft
  Passport accounts set up
• Passport may continue to evolve bugs have been
  uncovered

45
Four parts of Passport account

• Passport Unique Identifier (PUID)
• Assigned to the user when he or she sets up the
  account
• User profile, required to set up account
• Phone number or Hotmail or MSN.com e-mail address
• Also name, ZIP code, state, or country,
• Credential information
• E-mail address or phone number
• Minimum six-character password or PIN
• Four-digit security key, used for a second level
  of authentication on sites requiring stronger
  sign-in credentials
• Wallet
• Passport-based application at passport.com domain
• E-commerce sites with Express Purchase function
  use wallet information rather than prompt the
  user to type in data

46
Passport log-in
47
Trusted Intermediaries

• Symmetric key problem
• How do two entities establish shared secret key
  over network?
• Solution
• trusted key distribution center (KDC) acting as
  intermediary between entities

• Public key problem
• When Alice obtains Bobs public key (from web
  site, e-mail, diskette), how does she know it is
  Bobs public key, not Trudys?
• Solution
• trusted certification authority (CA)

48
Key Distribution Center (KDC)

• Alice, Bob need shared symmetric key.
• KDC server shares different secret key with each
  registered user (many users)
• Alice, Bob know own symmetric keys, KA-KDC KB-KDC
  , for communicating with KDC.

KDC
49
Key Distribution Center (KDC)
Q How does KDC allow Bob, Alice to determine
shared symmetric secret key to communicate with
each other?
KDC generates R1
KA-KDC(A,B)
KA-KDC(R1, KB-KDC(A,R1) )
Alice knows R1
Bob knows to use R1 to communicate with Alice
KB-KDC(A,R1)
Alice and Bob communicate using R1 as session
key for shared symmetric encryption
50
Certification Authorities

• Certification authority (CA) binds public key to
  particular entity, E.
• E (person, router) registers its public key with
  CA.
• E provides proof of identity to CA.
• CA creates certificate binding E to its public
  key.
• certificate containing Es public key digitally
  signed by CA CA says this is Es public key

Bobs public key
CA private key
certificate for Bobs public key, signed by CA
-
Bobs identifying information
51
Certification Authorities

• When Alice wants Bobs public key
• gets Bobs certificate (Bob or elsewhere).
• apply CAs public key to Bobs certificate, get
  Bobs public key

Bobs public key
CA public key

52
Single KDC/CA

• Problems
• Single administration trusted by all principals
• Single point of failure
• Scalability
• Solutions break into multiple domains
• Each domain has a trusted administration

53
Multiple KDC/CA Domains

• Secret keys
• KDCs share pairwise key
• topology of KDC tree with shortcuts
• Public keys
• cross-certification of CAs
• example Alice with CAA, Boris with CAB
• Alice gets CABs certificate (public key p1),
  signed by CAA
• Alice gets Boris certificate (its public key
  p2), signed by CAB (p1)

54
Backup Slides
55
MD5 Compression Function

• Each round has 16 steps of the form
• a b((ag(b,c,d)XkTi)
• a,b,c,d refer to the 4 words of the buffer, but
  used in varying permutations
• note this updates 1 word only of the buffer
• after 16 steps each word is updated 4 times
• where g(b,c,d) is a different nonlinear function
  in each round (F,G,H,I)

56
Functions and Random Numbers

• F(x,y,z) (x?y)?(x ? z)
• selection function
• G(x,y,z) (x ? z) ?(y ? z)
• H(x,y,z) x?y? z
• I(x,y,z) y?(x ? z)

57
Basic Steps...

• Only 4 per-round distinctive additive constants
• 0
• 20
• 40
• 60

58
Advantages of salt

• Without salt
• Same hash functions on all machines
• Compute hash of all common strings once
• Compare hash file with all known password files
• With salt
• One password hashed 212 different ways
• Precompute hash file?
• Need much larger file to cover all common strings
• Dictionary attack on known password file
• For each salt found in file, try all common
  strings