Hash Functions, the MD5 Algorithm and the Future (SHA-3)

Hash Functions, the MD5 Algorithm and the Future (SHA-3) Dylan Field, Fall ’08 SSU Math Colloquium

What is a hash?

First, Consider Humpty Dumpty...

Humpty Dumpty sat on a wall.

Humpty Dumpty had a great fall.

All the king’s horses and all the king’s men

Couldn’t put Humpty together again.

X

h(x)

BUT h(x) is a one way function

... so they can’t put Humpty together again.

x hash function h(x) Humpty falls

‘ hello’ MD5 x hash function h(x) Humpty falls

5d41402abc4b ‘ hello’ MD5 2a76b9719d91 1017c592 x hash function h(x) Humpty falls

- going backwards - - sdrawkcab gniog -

- going backwards - NO!!! - sdrawkcab gniog -

- going backwards - 5d41402abc4b 2a76b9719d91 1017c592 - sdrawkcab gniog -

- going backwards - 5d41402abc4b 2a76b9719d91 1017c592 ‘ hello’ - sdrawkcab gniog -

Requirements h(x)

Requirements h(x) Given h(x) cannot ﬁnd x 1

Requirements h(x) Given h(x) h(x) is cannot ﬁnd x constant 1 2

Requirements h(x) Given h(x) h(x) is Can’t ﬁnd x2 cannot ﬁnd x constant so h(x2)=h(x1) 1 2 3

Requirement #3 - Humpty Dumpty Style

Requirement #3 - Humpty Dumpty Style ≠

Requirement #3 - Humpty Dumpty Style ≠ ≠ ≠ ≠ .........

so how does it work?

‘ hello’

5d41402abc4b2a76b9719d911017c592

we’re going to focus on MD5

1. Convert ‘x’ to binary

‘ hello’ 0110100001100101011011000110110001101111

1. Convert ‘x’ to binary 2. Pad ‘x’ so that size of x (mod 512) = 0

‘hello’ in binary 0110100001100101011011000110110001101111 1 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 00000 0000000000101000

‘hello’ in binary 0110100001100101011011000110110001101111 1 add ‘1’ 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 00000 0000000000101000

‘hello’ in binary 0110100001100101011011000110110001101111 1 add ‘1’ 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0’s until 0000000000 0000000000 0000000000 0000000000 0000000000 x mod 512 = 496 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 00000 0000000000101000

‘hello’ in binary 0110100001100101011011000110110001101111 1 add ‘1’ 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0’s until 0000000000 0000000000 0000000000 0000000000 0000000000 x mod 512 = 496 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 00000 add 16 bit binary 0000000000101000 representation of x

xpadded = 0110100001100101011011000110110001101111 1 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 00000 0000000000101000

1. Convert ‘x’ to binary 2. Pad ‘x’ so that size of x (mod 512) = 0 3. Break ‘x’ into 512 bit sub parts and 32 bit words

0110100001100101011011000110110001101111 1 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 00000 0000000000101000 W1 = 01101000011001010110110001101100

1. Convert ‘x’ to binary 2. Pad ‘x’ so that size of x (mod 512) = 0 3. Break ‘x’ into 512 bit sub parts and 32 bit words 4. Assign values to k[i], r[i], w[g], h0, h1, h2 and h3.

k[i] = |sin(i+1)| x 232 where ‘i’ is in radians

k[i] = |sin(i+1)| x 232 where ‘i’ is in radians r[i] = Various round shift amounts

k[i] = |sin(i+1)| x 232 where ‘i’ is in radians r[i] = Various round shift amounts w[g] = Word number (0 – 15)

k[i] = |sin(i+1)| x 232 where ‘i’ is in radians r[i] = Various round shift amounts w[g] = Word number (0 – 15) h0 = a = 0x67452301 h1 = b = 0xEFCDAB89 h2 = c = 0x98BADCFE h3 = d = 0x10325476

1. Convert ‘x’ to binary 2. Pad ‘x’ so that size of x (mod 512) = 0 3. Break ‘x’ into 512 bit sub parts and 32 bit words 4. Assign values to k[i], r[i], w[g], h0, h1, h2 and h3. 5. Perform 64 rounds on each sub part

But ﬁrst... binary operations!

∧

∧ (AKA ‘AND’)

p q ∧ T T

p q ∧ T T T

p q ∧ T T T T F

p q ∧ T T T T F F

p q ∧ T T T T F F F T

p q ∧ T T T T F F F T F

p q ∧ T T T T F F F T F F F

p q ∧ T T T T F F F T F F F F

In binary: T=1 F=0

p q ∧ T T T T F F F T F F F F

p q ∧ bit 1 bit 2 ∧ T T T 1 1 1 T F F 1 0 0 F T F 0 1 0 F F F 0 0 0

∨

⊕

bit 1 bit 2 ∨ 1 1 1 1 0 1 0 1 1 0 0 0

⊕ “XOR is a type of logical disjunction on two operands that results in a value of “true” if and only if exactly one of the operands has a value of ‘true’”

bit 1 bit 2 ∨ bit 1 bit 2 ⊕ 1 1 1 1 1 F 1 0 1 1 0 T 0 1 1 0 1 T 0 0 0 0 0 F

¬

¬ (not)

¬1=0 ¬0=1

<< (bit shift)

1 0 1 0 1 0

0 1 0 1 0 0 1 0 1 0 0 0

Remember: a,b,c,d are h0-3

Operation A f = (b ∧ c) ∨ (¬ b ∧ d) g=i

Operation B f = (d ∧ b) ∨ ((¬ d) ∧ c) g = (5i + 1) mod 16

Operation C f=b⊕c⊕d g = (3i + 5) mod 16

Operation D f = c ⊕ (b ∨ (¬ d)) g = (7i) mod 16

A B C D

B b + {(a + f + k[i] + w[g]) << r[i]}

b + {(a + f + k[i] + w[g]) << r[i]} h1 h0 Calculated in The gth word Operations A-D (32 bit chunk) |sin(i+1)| x 232 ith pre-designated where ‘i’ is in radians shift

After all 64 rounds...

1. Convert ‘x’ to binary 2. Pad ‘x’ so that size of x (mod 512) = 0 3. Break ‘x’ into 512 bit sub parts and 32 bit words 4. Assign values to k[i], r[i], w[g], h0, h1, h2 and h3. 5. Perform 64 rounds on each sub part 6. Add a, b, c and d to register values

h0 = h0 + a h1 = h1 + b h2 = h2 + c h3 = h3 + d

1. Convert ‘x’ to binary 2. Pad ‘x’ so that size of x (mod 512) = 0 3. Break ‘x’ into 512 bit sub parts and 32 bit words 4. Assign values to k[i], r[i], w[g], h0, h1, h2 and h3. 5. Perform 64 rounds on each sub part 6. Add a, b, c and d to register values 7. Append the register values to create digest

128 bit digest

‘ hello’

5d41402abc4b2a76b9719d911017c592

So?

Applications

Applications Password Protection

Message Integrity Applications Password Protection

Message Integrity Applications Digital Password Signatures Protection

Password Protection

When you registered... MD5 ‘password’ 5f4dcc3b5aa765d61d8327deb882cf99

When you registered... MD5 ‘password’ 5f4dcc3b5aa765d61d8327deb882cf99 Data Base

‘password’

MD5 ‘password’

MD5 ‘password’ 5f4dcc3b5aa765d61d8327deb882cf99

5f4dcc3b5aa765d61d8327deb882cf99 = stored, hashed password?

5f4dcc3b5aa765d61d8327deb882cf99 = stored, hashed password? No. Give ‘incorrect password’ error

5f4dcc3b5aa765d61d8327deb882cf99 = stored, hashed password? No. Yes. Give ‘incorrect Let user password’ error into website

Attacks

Rainbow Tables

omgyouarenever 1c9fee8bd70a5afb6 goingtocrackthis 30fc4f38e97123f 123

and Brute Force Attacks

Message Integrity

digest

File Veriﬁcation

File Veriﬁcation Guarding against corruption

File Veriﬁcation Guarding against corruption Proving you have something before you release it

Attacks

Nostradamus Attack

But on November 30th 2007...

“We have used a Sony Playstation 3 to correctly predict the outcome of the 2008 US presidential elections. In order not to inﬂuence the voters we keep our prediction secret, but commit to it by publishing its cryptographic hash on this website. The document with the correct prediction and matching hash will be revealed after the elections.” - Marc Stevens, Arjen Lenstra and Benne de Weger

3D515DEAD7AA1656 0ABA3E9DF05CBC80

But how could they have known!?!?

But how could they have known!?!? They didn’t.

3D515DEAD7AA1656 0ABA3E9DF05CBC80

Digital Signatures

MD5 hash

MD5 hash private key encrypted

MD5 hash private key hash encrypted public key

MD5 hash private MD5 key hash encrypted public key

MD5 hash private MD5 key hash ✔ encrypted public key

Attacks

Collision Attack

hash private MD5 key hash ✔ encrypted public key

Changed hash Message MD5 hash ✔ encrypted public key

Very Dangerous!

Birthday Attack

Relies on ‘Birthday Paradox’

Relies on ‘Birthday Paradox’ First we calculate the chance no one has the same birthday

p(1)=100%

p(2)=(1)(1 - 1/365)

p(3)=(1)(1 - 1/365)(1 - 2/365)

To Generalize...

P(n)= 365! . 365 n(365-n)!

23 50% chance

30 70.6% chance

50 97% chance

We can use this property to ﬁnd out how many hashes must be calculated to ﬁnd a collision.

Current State of MD5

MD5 =

MD5 = Broken

The Future of Hashes

Submissions were due on October 30th

Currently Submitted

Skein Maraca BLAKE MD6 Keccak CubeHash Edon-R Ponic EnRUPT SHAMATA MCSSHA-3 Sgàil Blue Midnight Wish Grøstl ESSENCE WaMM Boole NaSHA NKS2D Waterfall

Skein BLAKE MD6 Maraca Keccak CubeHash Edon-R Ponic EnRUPT SHAMATA MCSSHA-3 Sgàil Blue Midnight Wish Grøstl ESSENCE WaMM Boole NaSHA NKS2D Waterfall

Thank you for coming!

Any Questions?

Hash Functions, the MD5 Algorithm and the Future (SHA-3)

0 comments

Notes on slide 1

1 Favorite