Hashes, Message Digests

1
Hashes, Message Digests

• A condensed representation of a message.
• Encrypting whole message is very expensive.
• //for authenticity, integrity, and
  non-repudiation.//
• A signed message digest (or hash) of the message
  is much more efficient.
• ltgt Usually much shorter than the message.
• ltgt Much faster to encrypt and decrypt.
• ltgt Acts as a proxy for a lengthy message.
• ltgt Make public-key cryptography more popular.
• ltgt Like digital fingerprint or checksum of
  message.

2
How it works

• A makes a message digest from the plaintext
  message.
• A signs the message digest and sends it with the
  message to B.
• B independently recreates the message digest from
  the received plaintext message.
• B decrypts the message digest received with the
  message from A.
• A checks if the message digest in the recd.
  message is identical to the one he created.

3
Security Properties and Assurances

• Message integrity if the message is changed, its
  message digest will not match.
• Authentication the message digest is signed with
  the private key of the sender (A).
• Non-Repudiation the message digest is signed
  with the private key of the sender.
• //The message can be encrypted for secrecy.//

4
Hash Properties

• One-way It is extremely difficult to invert the
  hash function or message digest.
• //insures original message not recoverable.//
• Collision Freeness
• A collision occurs when two or more distinct
  messages hash to the same value.
• ltgt Collisions are inevitable.
• ltgt But bad hash functions can produce lot more
  collisions.
• Collisions should be avoided. Why?

5
Examples of Hash Functions

• Non-keyed hash functions
• MD5 (128-bit digest)
• SHA-1 (Secure Hash Algorithm) (160-bit digest)

6
Keyed Message Digests

• Depend upon a secret key for one-wayness and
  collision free.
• Such a digest is called Message Authentication
  Code (MAC).
• Two items a file and a secret key.
• Using secret key, an encryption procedure,
• a node computes a keyed hash value.
• gt It is much smaller than the message.
• gt It can not be inverted (decrypted).

7
Generation of MAC

• The file is divided into chunks of 64 bytes.
• First two chunks are combined to make a chunk of
  64 bytes.
• DES using secret is applied to the new chunk.
• Output of DES operation is combined with the
  third 64 byte chunk. (to give a 64 byte chunk).
• DES is applied to this new 64 byte chunk.
• The output of DES is combined with the fourth 64
  byte chunk.
• So on,...