cryptography and ntk security 2019/20

CH 3 - AUTHENTICATION AND HASH FUNCTION

3.1 Authentication Requirements
In the context of communications across a network, the following attacks can be identified:
1. Disclosure: Release of message contents to any person or process not possessing the
appropriate cryptographic key.
2. Traffic analysis: Discovery of the pattern of traffic between parties. In a connection-oriented
application, the frequency and duration of connections could be determined. In either a
connection-oriented or connectionless environment, the number and length of messages
between parties could be determined.
3. Masquerade: Insertion of messages into the network from a fraudulent source. This includes
the creation of messages by an opponent that are purported to come from an authorized
entity. Also included are fraudulent acknowledgments of message receipt or nonreceipt by
someone other than the message recipient.
4. Content modification: Changes to the contents of a message, including insertion, deletion,
transposition, and modification.
5. Sequence modification: Any modification to a sequence of messages between parties,
including insertion, deletion, and reordering.
6. Timing modification: Delay or replay of messages. In a connection-oriented application, an
entire session or sequence of messages could be a replay of some previous valid session, or
individual messages in the sequence could be delayed or replayed. In a connectionless
application, an individual message (e.g., datagram) could be delayed or replayed.
7. Source repudiation: Denial of transmission of message by source.
8. Destination repudiation: Denial of receipt of message by destination.

Measures to deal with the first two attacks are in the realm of message confidentiality. Measures
to deal with items 3 through 6 in the foregoing list are generally regarded as message
authentication. Mechanisms for dealing specifically with item 7 come under the heading of
digital signatures. Generally, a digital signature technique will also counter some or all of the
attacks listed under items 3 through 6. Dealing with item 8 may require a combination of the use
of digital signatures and a protocol designed to counter this attack.

In summary, message authentication is a procedure to verify that received messages come from
the alleged source and have not been altered. Message authentication may also verify sequencing
and timeliness. A digital signature is an authentication technique that also includes measures to
counter repudiation by the source.

1
 cryptography and ntk security 2019/20

3.2 Authentication functions

Any message authentication or digital signature mechanism has two levels of functionality. At
the lower level, there must be some sort of function that produces an authenticator: a value to be
used to authenticate a message. This lower-level function is then used as a primitive in a higher-
level authentication protocol that enables a receiver to verify the authenticity of a message.

This section is concerned with the types of functions that may be used to produce an
authenticator. These may be grouped into three classes, as follows:

 Message encryption: The ciphertext of the entire message serves as its authenticator
 Message authentication code (MAC): A function of the message and a secret key that
produces a fixed-length value that serves as the authenticator
 Hash function: A function that maps a message of any length into a fixed-length hash
value, which serves as the authenticator.
3.3 Message Authentication Codes
An alternative authentication technique involves the use of a secret key to generate a small fixed-
size block of data, known as a cryptographic checksum or MAC that is appended to the message.
This technique assumes that two communicating parties, say A and B, share a common secret
key K. When A has a message to send to B, it calculates the MAC as a function of the message
and the key: MAC = C(K, M), where

M = input message

C = MAC function

K = shared secret key

MAC = message authentication code

The message plus MAC are transmitted to the intended recipient. The recipient performs the
same calculation on the received message, using the same secret key, to generate a new MAC.
The received MAC is compared to the calculated MAC. If we assume that only the receiver and
the sender know the identity of the secret key, and if the received MAC matches the calculated
MAC, then

The receiver is assured that the message has not been altered. If an attacker alters the
message but does not alter the MAC, then the receiver's calculation of the MAC will
differ from the received MAC. Because the attacker is assumed not to know the secret
key, the attacker cannot alter the MAC to correspond to the alterations in the message.

2
 cryptography and ntk security 2019/20

The receiver is assured that the message is from the alleged sender. Because no one else
knows the secret key, no one else could prepare a message with a proper MAC.
If the message includes a sequence number (such as is used with HDLC, X.25, and TCP),
then the receiver can be assured of the proper sequence because an attacker cannot
successfully alter the sequence number.
Basic Uses of Message Authentication Code C
 Message authentication
A B: M || C(K, M)
Provides authentication only A and B share K

 Message authentication and confidentiality: authentication tied to plaintext

AB: E(K2, [M||C(K1, M)])
Provides authentication only A and B share K1

Provides confidentiality only A and B share K2

 Message authentication and confidentiality: authentication tied to ciphertext

A B: E(K2, M)||C(K1, E(K2, M))
Provides authentication using K1

Provides confidentiality using K2

3.4 Hash Functions

A variation on the message authentication code is the one-way hash function. As with the
message authentication code, a hash function accepts a variable-size message M as input and
produces a fixed size output, referred to as a hash code H(M). Unlike a MAC, a hash code does
not use a key but is a function only of the input message. The hash code is also referred to as a
message digest or hash value. The hash code is a function of all the bits of the message and
provides an error-detection capability: A change to any bit or bits in the message results in a
change to the hash code. For example, the way windows stores passwords. For example, if the
password is password, then Windows will first hash it producing something like:
0BD181063899C9239016320B50D3E896693A96DF

It then stores it in the SAM (Security Accounts Manager) file in the Windows System directory.
When you log on, Windows cannot un-hash your password (remember it is one-way). So, what
Windows does is take whatever password you type in, hash it, and then compare the result with
what is in the SAM file. If they match (exactly), then you can log in.

In general terms, the principal object of a hash function is data integrity. A change to any bit or
bits in M results, with high probability, in a change to the hash code.

3
 cryptography and ntk security 2019/20

The kind of hash function needed for security applications is referred to as a cryptographic hash
function. A cryptographic hash function is an algorithm for which it is computationally infeasible
(because no attack is significantly more efficient than brute force) to find either (a) a data object
that maps to a pre-specified hash result (the one-way property) or (b) two data objects that map
to the same hash result (the collision-free property). Because of these characteristics, hash
functions are often used to determine whether or not data has changed.

The two most common hashing algorithms are MD5 (Message Digest version 5) which produces
a 128-bit hash and Secure Hash Algorithm or SHA (SHA-1 and later versions like SHA- 256) by
NIST which produces a 160-bit message digest.

Applications of Cryptographic Hash Functions:

i) Message Authentication
Message authentication is a mechanism or service used to verify the integrity of a message.
Message authentication assures that data received are exactly as sent (i.e., contain no
modification, insertion, deletion, or replay). In many cases, there is a requirement that the
authentication mechanism assures that purported identity of the sender is valid. When a hash
function is used to provide message authentication, the hash function value is often referred to as
a message digest.

The essence of the use of a hash function for message authentication is as follows. The sender
computes a hash value as a function of the bits in the message and transmits both the hash value
and the message. The receiver performs the same hash calculation on the message bits and
compares this value with the incoming hash value. If there is a mismatch, the receiver knows that
the message (or possibly the hash value) has been altered.

The hash function must be transmitted in a secure fashion. That is, the hash function must be
protected so that if an adversary alters or replaces the message, it is not feasible for adversary to
also alter the hash value to fool the receiver. For example, if Alice transmits a data block and
attaches a hash value. Darth intercepts the message, alters or replaces the data block, and
calculates and attaches a new hash value. Bob receives the altered data with the new hash value
and does not detect the change. To prevent this attack, the hash value generated by Alice must be
protected. A variety of ways in which a hash code can be used to provide message
authentication, as follows.
a. The message plus concatenated hash code is encrypted using symmetric encryption. Because only
A and B share the secret key, the message must have come from A and has not been altered.
Because encryption is applied to the entire message plus hash code, confidentiality is also provided.

4
 cryptography and ntk security 2019/20

b. Only the hash code is encrypted, using symmetric encryption. This reduces the processing burden
for those applications that do not require confidentiality.
c. It is possible to use a hash function but no encryption for message authentication. The technique
assumes that the two communicating parties share a common secret value S. A computes the hash
value over the concatenation of M and S and appends the resulting hash value to M. Because B
possesses S, it can re-compute the hash value to verify. Because the secret value itself is not sent, an
opponent cannot modify an intercepted message and cannot generate a false message.
d. Confidentiality can be added to the approach of method (c) by encrypting the entire message plus
the hash code.
When confidentiality is not required, method (b) has an advantage over methods (a) and (d),
which encrypts the entire message, in that less computation is required. Nevertheless, there has
been growing interest in techniques that avoid encryption. Several reasons for this interest are:
 Encryption software is relatively slow.
 Encryption hardware costs are not negligible.
 Encryption hardware is optimized toward large data sizes.
 Encryption algorithms may be covered by patents, and there is a cost associated with licensing
their use.
The message digest can be encrypted using symmetric encryption if it is assumed that only the
sender and receiver share the encryption key.

ii) Digital Signature

Another important application, which is similar to the message authentication application, is the
digital signature. The operation of the digital signature is similar to that of the MAC. In the case
of the digital signature, the hash value of a message is encrypted with a user’s private key.
Anyone who knows the user’s public key can verify the integrity of the message that is
associated with the digital signature. In this case, an attacker who wishes to alter the message
would need to know the user’s private key.

Confidentiality ensures that messages cannot be intercepted and read by eavesdroppers, i.e.,
encryption protects against passive attack.

A different requirement is to protect against active attack (falsification of data and transactions).
Protection against such attacks is known as message authentication.

A message, file, document, or other collection of data is said to be authentic when it is genuine
(not altered) and comes from its alleged source.

A digital signature is not used to ensure the confidentiality of a message, but rather to guarantee
who sent the message, i.e., authentication (nonrepudiation); it proves who the sender is.

5
 cryptography and ntk security 2019/20

Nonrepudation can be source repudiation (denial of transmission of message by source) or

destination repudiation (denial of receipt of message by destination).

Just as with handwritten signatures, digital signing should be done in a way that is verifiable and
non-forgeable. Digital signature is also used for Data/Message Integrity; it ensures that messages
are protected against modification.

Digital signature reverses the asymmetric encryption process

Notation: K X- : Private key of X

K X+ : Public key of X
Alice encrypts the message using her private key C = E(KA-, M) – this is Alice’s signature.
Sends the encrypted message to Bob

Bob then decrypts the signature using Alice’s public key M = D(KA+, C) .

If successful, he ensures that it comes from Alice – verifiable. If Bob can decrypt it with Alice’s
public key, the message must have been encrypted by Alice. No one else has Alice’s private key,
and therefore no one else could have created a cipher text that could be decrypted with Alice’s
public key – nonforgeable . Therefore, the encrypted message serves as a digital signature. In
addition, it is impossible to alter the message without access to Alice’s private key, so the
message is authenticated both in terms of source and in terms of data integrity.

But anyone can decrypt the message using Alice’s public key if it is not important that the
message be kept secret. To combine both confidentiality and authentication.

 Alice has to first encrypt the message using her private key
 Then encrypt the message with Bob’s public key C = E(KB+, E(KA-, M)). Sends the
encrypted message to Bob.
 Bob decrypts the message using his private key.
 Bob then decrypts the message using Alice’s public key M = D(KA+, D(KB-, C)).
Disadvantage: The public-key algorithm must be applied four times rather than two in each
communication which has an impact on efficiency.
3.5 Security of Hash Functions and MACs
Just as with symmetric and public-key encryption, we can group attacks on hash functions and
MACs into two categories: brute-force attacks and cryptanalysis.