Hash Functions and Message Authentication
Hash Functions and Message Authentication
The exam tests the three hash security properties, current algorithm status, and the difference between a plain hash, a MAC, and a signature.
Properties and algorithms
- Preimage resistance - given h, finding any m with H(m) = h is infeasible.
- Second preimage resistance - given m1, finding m2 ≠ m1 with the same digest is infeasible.
- Collision resistance - finding any pair with equal digests is infeasible. Birthday bound: a 128-bit digest collides at about 2^64 work, so its collision strength is 64 bits.
- Status. MD5 is broken (practical chosen-prefix collisions since 2004). SHA-1 is broken for collision resistance (SHAttered, 2017). Use SHA-256/384/512 or SHA-3.
- HMAC - H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ message)). A keyed MAC built on a hash; it authenticates the message and its origin.
- Salt and KDFs - a unique random salt per password defeats precomputed rainbow tables; slow KDFs (PBKDF2, bcrypt, scrypt, Argon2) raise per-guess cost.
Worked example
A naive design sends message ‖ SHA-256(secret ‖ message). An attacker who captures one message can compute SHA-256(secret ‖ message ‖ extra) without knowing the secret, because of the length-extension property - the appended data verifies. Replacing the construction with HMAC(secret, message) blocks the extension, because the key is hashed both inside and outside the construction.
Traps
- Assuming a hash alone authenticates data: an attacker who alters the message simply recomputes the digest.
- Calling a MAC non-repudiable - both parties hold the shared key.
- Using CRC32 or a checksum as an integrity control against a malicious actor.
- Encrypting a hash and calling it a digital signature.
- Forgetting that unsalted fast hashes are rainbow-table fodder.