AUTHENTICATION REQUIREMENTS

In the context of communication across a network, the following attacks can be identified:
Disclosure – releases of message contents to any person or process not possessing the
appropriate cryptographic key.
Traffic analysis – discovery of the pattern of traffic between parties.
Masquerade – insertion of messages into the network fraudulent source.
Content modification – changes to the content of the message, including
insertion deletion, transposition and modification.
Sequence modification – any modification to a sequence of messages between parties,
including insertion, deletion and reordering.
Timing modification – delay or replay of messages.

Source repudiation – denial of transmission of message by source.

Destination repudiation – denial of transmission of message by destination.
easures to deal with first two attacks are in the realm of message confidentiality. Measures to deal
with 3 through 6 are regarded as message authentication. Item 7 comes under digital signature and
dealing with item 8 may require a combination of digital signature and a protocol to counter this
attack.

AUTHENTICATION FUNCTIONS

Any message authentication or digital signature mechanism can be viewed as having fundamentally
two levels. At the lower level, there may be some sort of function that produces an authenticator: a
value to be used to authenticate a message. This lower layer function is then used as primitive in a
higher-layer authentication protocol that enables a receiver to verify the authenticity of a message.
The different types of functions that may be used to produce an authenticator
are as follows:
Message encryption – the cipher text of the entire message serves as its
authenticator.
Message authentication code (MAC) – a public function of the message and a secret
key that produces a fixed length value serves as the authenticator.
Hash function – a public function that maps a message of any length into a fixed length
hash value, which serves as the authenticator.

Message encryption
Message encryption by itself can provide a measure of authentication. The analysis differs
from symmetric and public key encryption schemes.
Suppose the message can be any arbitrary bit pattern. In that case, there is no way to determine
automatically, at the destination whether an incoming message is the ciphertext of a legitimate
message. One solution to this problem is to force the plaintext to have some structure that is easily
recognized but that cannot be replicated without recourse to the encryption function. We could, for
example, append an error detecting code, also known as Frame Check Sequence (FCS) or checksum
to each message before encryption
‘A’ prepares a plaintext message M and then provides this as input to a function F that produces an
FCS. The FCS is appended to M and the entire block is then encrypted. At the destination, B decrypts
the incoming block and treats the result as a message with an appended FCS. B applies the same
function F to attempt to reproduce the FCS. If the calculated FCS is equal to the incoming FCS, then
the message is considered authentic.
In the internal error control, the function F is applied to the plaintext, whereas in external error control,
F is applied to the ciphertext (encrypted message).

MESSAGE AUTHENTICATION CODE (MAC)

An alternative authentication technique involves the use of secret key to generate a small fixed size
block of data, known as cryptographic checksum or MAC that is appended to the message. This
technique assumes that two communication parties say A and B, share a common secret key ‘k’.
When A has to send a message to B, it calculates the MAC as a function of the message and thekey.
MAC = CK(M) Where M – input message
C – MAC function
K – Shared secret key

+MAC - Message Authentication Code

The message plus MAC are transmitted to the intended recipient. The recipient performs the same
calculation on the received message, using the shared secret key, to generate a new MAC. The
received MAC is compared to the calculated MAC. If it is equal, then the message is considered
authentic.
A MAC function is similar to encryption. One difference is that MAC algorithm need not be
reversible, as it must for decryption. In general, the MAC function is a many- to-one function.
Requirements for MAC:

When an entire message is encrypted for confidentiality, using either symmetric or asymmetric
encryption, the security of the scheme generally depends on the bit length of the key. Barring some
weakness in the algorithm, the opponent must resort to a brute- force attack using all possible keys.
On average, such an attack will require 2(k-1) attempts for a k-bit key.

In the case of a MAC, the considerations are entirely different. Using brute-force methods, how
would an opponent attempt to discover a key?

If confidentiality is not employed, the opponent has access to plaintext messages and their associated
MACs. Suppose k > n; that is, suppose that the key size is greater than the MAC size. Then, given a
known M1 and MAC1, with MAC1 = CK (M1), the cryptanalyst can perform MACi
= CKi (M1) for all possible key values Ki.

At least one key is guaranteed to produce a match of MACi = MAC1.

Note that a total of 2k MACs will be produced, but there are only 2n < 2k different MAC values.
Thus, a number of keys will produce the correct MAC and the opponent has no way of knowing
which is the correct key. On average, a total of 2k/2n = 2(k-n) keys will produce a match. Thus, the
opponent must iterate the attack:

Round 1

Given: M1, MAC1 = CK( M1)

Compute MACi = CKi (M1) for all 2k keys

Number of matches ≈2(k-n)

Round 2

Given: M2, MAC2 = CK( M2)

Compute MACi = CKi (M2) for the 2(k-n) keys resulting from Round 1

Number of matches ≈2(k-2xn)

and so on. On average, a rounds will be needed if k = a x n. For example, if an 80-bit key is used and
the MAC is 32 bits long, then the first round will produce about 248 possible keys. The second round
will narrow the possible keys to about 216 possibilities. The third round should produce only
a single key, which must be the one used by the sender.

If the key length is less than or equal to the MAC length, then it is likely that a first round will produce
a single match.
Thus, a brute-force attempt to discover the authentication key is no less effort and may be more effort
than that required to discover a decryption key of the same length. However, other attacksthat do
not require the discovery of the key are possible.

Consider the following MAC algorithm. Let M = (X1||X2||...||Xm) be a message that is treated as a
concatenation of 64-bit blocks Xi. Then define

Δ(M)= X1 X2 … Xm

Ck(M)=Ek(Δ(M)

where is the exclusive-OR (XOR) operation and the encryption algorithm is DES in electronic
codebook mode. Thus, the key length is 56 bits and the MAC length is 64 bits. If an opponent
observes {M||C(K, M)}, a brute-force attempt to determine K will require at least 256 encryptions.
But the opponent can attack the system by replacing X1 through
Xm-1 with any desired values Y1 through Ym-1 and replacing Xm with Ym where Ym is calculated
as follows:

Ym = Y1 Y2 ... Ym1 Δ(M)

The opponent can now concatenate the new message, which consists of Y 1 through Ym, with the
original MAC to form a message that will be accepted as authentic by the receiver. With this tactic,
any message of length 64 x (m-1) bits can be fraudulently inserted.

Then the MAC function should satisfy the following requirements: The MAC function should have

the following properties:

If an opponent observes M and CK(M), it should be computationally infeasible for
the opponent to construct a message M’ such that CK(M’) = CK(M)
CK(M) should be uniformly distributed in the sense that for randomly chosen messages,

M and M’, the probability that CK(M) = CK(M’) is 2-n where n is the number of bitsin the MAC.
Let M’ be equal to some known transformation on M. i.e., M’ = f(M).

MAC based on DES

One of the most widely used MACs, referred to as Data Authentication Algorithm
(DAA) is based on DES.
The algorithm can be defined as using cipher block chaining (CBC) mode of operation of DES with
an initialization vector of zero. The data to be authenticated are grouped into contiguous 64-bit blocks:
D1, D2 … Dn. if necessary, the final block is padded on the right with zeros to form afull 64-bit
block. Using the DES encryption algorithm and a secret key, a data authentication code
(DAC) is calculated as follows:
O1 = EK(D1)
O2 = EK(D2 O1)
O3 = EK(D3 O2) …
ON = EK(DN ON-1)

HASH FUNCTIONS
A variation on the message authentication code is the one way hash function. As with MAC, a hash
function accepts a variable size message M as input and produces a fixed-size output, referred to as
hash code H(M). Unlike a MAC, a hash code does not use a key but is a function only of the input
message. The hash code is also referred to as a message digest or hash value.
There are varieties of ways in which a hash code can be used to provide message authentication, as
follows:
a) The message plus the hash code is encrypted using symmetric encryption. This is identical to that
of internal error control strategy. Because encryption is applied to the entire message plus the hash
code, confidentiality is also provided.
b) Only the hash code is encrypted, using symmetric encryption. This reduces the processing
burden for those applications that do not require confidentiality.

c) Only the hash code is encrypted, using the public key encryption and using th e
sender’s private key. It provides authentication plus the digital signature.
d) If confidentiality as well as digital signature is desired, then the message plus the public key
encrypted hash code can be encrypted using a symmetric secret key.

e) This technique uses a hash function, but no encryption for message authentication. This
technique assumes that the two communicating parties share a common secret value ‘S’. The source
computes the hash value over the concatenation of M and S and appends the resulting hash value to
M.
f) Confidentiality can be added to the previous approach by encrypting the entire message plus
the hash code.

A hash value h is generated by a function H of the form h = H(M)

Where M is a variable-length message and H(M) is the fixed-length hash value. The hash value is
appended to the message at the source at a time when the message is assumed or known to be correct.
The receiver authenticates that message by re-computing the hash value.

Requirements for a Hash Function

1. H can be applied to a block of data of any size.

2. H produces a fixed-length output.
3. H(x) is relatively easy to compute for any given x, making both hardware and
software implementations practical.
4. For any given value h, it is computationally infeasible to find x such that H(x) =
h. This is sometimes referred to in the literature as the one-way property.

5. For any given block x, it is computationally infeasible to find y x such that

H(y) = H(x). This is sometimes referred to as weak collision resistance.
6. It is computationally infeasible to find any pair (x, y) such that H(x) = H(y). This is sometimes
referred to as strong collision resistance.

The first three properties are requirements for the practical application of a hash function tomessage
authentication. The fourth property, the one-way property, states that it is easy to generatea code
given a message but virtually impossible to generate a message given a code. The fifth property
guarantees that an alternative message hashing to the same value as a given message cannot be found.
This prevents forgery when an encrypted hash code is used.The sixth property refers to how resistant
the hash function is to a type of attack known as the birthday attack, whichwe examine shortly.

Simple Hash Functions

All hash functions operate using the following general principles. The input (message, file, etc.) is
viewed as a sequence of n-bit blocks. The input is processed one block at a time in an iterative fashion
to produce an n-bit hash function.

One of the simplest hash functions is the bit-by-bit exclusive-OR (XOR) of every block. This can be
expressed as follows:

Ci = bi1 bi1 ... bim

Where
Ci = ith bit of the hash code, 1 ≤i ≤n
m = number of n-bit blocks in the input bij = ith bit in jth block
= XOR operation

Thus, the probability that a data error will result in an unchanged hash value is 2n. With more
predictably formatted data, the function is less effective. For example, in most normal text files, the
high-order bit of each octet is always zero. So if a 128-bit hash value is used, instead of an

effectiveness of 2128, the hash function on this type of data has an effectiveness of 2112.
A simple way to improve matters is to perform a one-bit circular shift, or rotation, on the hash value
after each block is processed. The procedure can be summarized as follows:
1. Initially set the n-bit hash value to zero.
2. Process each successive n-bit block of data as follows:
a. Rotate the current hash value to the left by one bit. b. XOR the block into the hash value.

Birthday Attacks
Suppose that a 64-bit hash code is used. One might think that this is quite secure. For example,
if an encrypted hash code C is transmitted with the corresponding unencrypted

Message M, then an opponent would need to find an M' such that H(M') = H(M) to substitute
another message and fool the receiver.

On average, the opponent would have to try about 263 messages to find one that matches the hash
code of the intercepted message
However, a different sort of attack is possible, based on the birthday paradox The source, A, is
prepared to "sign" a message by appending the appropriate m-bit hash code and encrypting that hash
code with A's private key

1. The opponent generates 2m/2 v a r i a t i ons on the message, all of which convey essentiallythe
same meaning. (Fraudulent message
2. The two sets of messages are compared to find a pair of messages that produces the same
hash code. The probability of success, by the birthday paradox, is greater than 0.5. If no match is
found, additional valid and fraudulent messages are generated until a match is made.
3. The opponent offers the valid variation to A for signature. This signature can then be attached
to the fraudulent variation for transmission to the intended recipient. Because the two variations have
the same hash code, they will produce the same signature; the opponent is assured of success even
though the encryption key is not known.

Thus, if a 64-bit hash code is used, the level of effort required is only on the order of 232 .
Block Chaining Techniques
Divide a message M into fixed-size blocks M1,M2,..., MN and use a symmetric encryption system
such as DES to compute the hash code G as follows:
Ho = initial value
Hi = EMi [Hi-1 ] G = HN
This is similar to the CBC technique, but in this case there is no secret key. As with any hash code,
this scheme is subject to the birthday attack, and if the encryption algorithm is DES and only a 64-
bit hash code is produced, then the system is vulnerable.
Furthermore, another version of the birthday attack can be used even if the opponent has access to
only one message and its valid signature and cannot obtain multiple signings.
Here is the scenario; we assume that the opponent intercepts a message with a signature in the form
of an encrypted hash code and that the unencrypted hash code is m bits long:

1. Use the algorithm defined at the beginning of this subsection to calculate the unencrypted
hash code G.

2. Construct any desired message in the form Q1, Q2,..., QN2.

3. Compute for Hi = EQi [Hi-1 ]for 1 ≤i ≤(N-2).

4. Generate 2m/2 random blocks; for each block X, compute EX[HN-2.] Generate an additional

2m/2 random blocks; for each block Y, compute DY[G], where D is the decryption function
corresponding to E.
5. Based on the birthday paradox, with high probability there will be an X and Y
such that EX [HN-2 ] = DY[ G].
6. Form the message Q1, Q2,..., QN-2, X, Y. This message has the hash code G and
therefore can be used with the intercepted encrypted signature.

This form of attack is known as a meet-in-the-middle attack.

Security of Hash Functions and Macs

Just as with symmetric and public-key encryption, we can group attacks on hash functions
and MACs into two categories: brute-force attacks and cryptanalysis.
Brute-Force Attacks
The nature of brute-force attacks differs somewhat for hash functions and MACs.
Hash Functions
The strength of a hash function against brute-force attacks depends solely on the length of the hash
code produced by the algorithm. Recall from our discussion of hash functions that there are three
desirable properties:
One-way: For any given code h, it is computationally infeasible to find x such that
H(x) = h.
Weak collision resistance: For any given block x, it is computationally infeasible to find
y x with H(y) = H(x).
Strong collision resistance: It is computationally infeasible to find any pair (x, y)
Such that H(x) = H(y).
For a hash code of length n, the level of effort required, as we have seen is proportional
to the following:

One way 2n
Weak collision resistance 2n
Strong collision resistance 2n/2

Cryptanalysis
As with encryption algorithms, cryptanalytic attacks on hash functions and MAC algorithms seek to
exploit some property of the algorithm to perform some attack other than an exhaustive search.

Hash Functions
In recent years, there has been considerable effort, and some successes, in developing cryptanalytic
attacks on hash functions. To understand these, we need to look at the overall structure of a typical
secure hash function, and is the structure of most hash functions in use today, including SHA and
Whirlpool.
The hash function takes an input message and partitions it into L fixed-sized blocks of b bits each. If
necessary, the final block is padded to b bits.
The final block also includes the value of the total length of the input to the hashfunction.The
inclusion of the length makes the job of the opponent more difficult.

Either the opponent must find two messages of equal length that hash to the same value or two
messages of differing lengths that, together with their length values, hash to the same value.
The hash algorithm involves repeated use of a compression function, f, that takes two inputs (an
n-bit input from the previous step, called the chaining variable, and a b-bit block) and produces an
n-bit output. At the start of hashing, the chaining variable has an initial value that is specified as
part of the algorithm. The final value of the chaining variable is the hash value. Often, b > n; hence
the term compression. The hash function can be summarized as follows:

CVo = IV = initial n-bit value CVi = f (CVi-1, Yi-1) 1 ≤i ≤L H(M) = CVL

Where the input to the hash function is a message M consisting of the blocks Yo, Y1,..., YL-1.
The structure can be used to produce a secure hash function to operate on a message of any length.

Message Authentication Codes

There is much more variety in the structure of MACs than in hash functions, so it is difficult to
generalize about the cryptanalysis of MACs. Further, far less work has been done on developing such
attacks.
Message Authentication.
i) Message authentication is concerned with:

o protecting the integrity of a message

o validating identity of originator

o non-repudiation of origin (dispute resolution)

ii) electronic equivalent of a signature on a message

iii) An authenticator, signature, or message authentication code (MAC) is sent along with
the message

iv) The MAC is generated via some algorithm which depends on both the message and some
(public or private) key known only to the sender and receiver

v) The message may be of any length

vi) the MAC may be of any length, but more often is some fixed size, requiring the use of some
hash function to condense the message to the required size if this is not acheived by the
authentication scheme

vii) need to consider replay problems with message and MAC

o require a message sequence number, timestamp or negotiated random values

Authentication using Private-key Ciphers

viii) if a message is being encrypted using a session key known only to the sender and receiver,
then the message may also be authenticated

o since only sender or receiver could have created it

o any interference will corrupt the message (provided it includes sufficient redundancy to detect
change)
o but this does not provide non-repudiation since it is impossible to prove who created the
message

ix) message authentication may also be done using the standard modes of use of a block cipher

o sometimes do not want to send encrypted messages

o can use either CBC or CFB modes and send final block, since this will depend on all
previous bits of the message

o no hash function is required, since this method accepts arbitrary length input and produces a
fixed output

o usually use a fixed known IV

o this is the approached used in Australian EFT standards AS8205

o major disadvantage is small size of resulting MAC since 64-bits is probably too small

Hashing Functions
x) hashing functions are used to condense an arbitrary length message to a fixed size, usually
for subsequent signature by a digital signature algorithm

xi) good cryptographic hash function h should have the following properties:

o h should destroy all holomorphic structures in the underlying public key cryptosystem (be
unable to compute hash value of 2 messages combined given their individual hash values)

o h should be computed on the entire message

o h should be a one-way function so that messages are not disclosed by their signatures

o it should be computationally infeasible given a message and its hash value to compute
another message with the same hash value

o should resist birthday attacks (finding any 2 messages with the same hash value, perhaps
by iterating through minor permutations of 2 messages )

xii) it is usually assumed that the hash function is public and not keyed

xiii) traditional CRCs do not satisfy the above requirements

xiv) length should be large enough to resist birthday attacks (64-bits is now regarded as too
small, 128-512 proposed)

MD2, MD4 and MD5

xv) family of one-way hash functions by Ronald Rivest

xvi) MD2 is the oldest, produces a 128-bit hash value, and is regarded as slower and less secure
than MD4 and MD5

xvii) MD4 produces a 128-bit hash of the message, using bit operations on 32-bit operands for
fast implementation

R L Rivest, "The MD4 Message Digest Algorithm", Advances in Cryptology - Crypto'90, Lecture
Notes in Computer Science No 537, Springer-Verlag 1991, pp303-311

xviii) MD4 overview

o pad message so its length is 448 mod 512

o append a 64-bit message length value to message

o initialise the 4-word (128-bit) buffer (A,B,C,D)

o process the message in 16-word (512-bit) chunks, using 3 rounds of 16 bit operations
each on the chunk & buffer

o output hash value is the final buffer value

xix) some progress at cryptanalysing MD4 has been made, with a small number of collisions
having been found

xx) MD5 was designed as a strengthened version, using four rounds, a little more complex than
in MD4 [2]

xxi) a little progress at cryptanalysing MD5 has been made with a small number of collisions
having been found

xxii) both MD4 and MD5 are still in use and considered secure in most practical applications

xxiii) both are specified as Internet standards (MD4 in RFC1320, MD5 in RFC1321)
3.3.1 SHA (Secure Hash Algorithm)
xxiv) SHA was designed by NIST & NSA and is the US federal standard for use with the DSA
signature scheme (nb the algorithm is SHA, the standard is SHS)

xxv) it produces 160-bit hash values

xxvi) SHA overview[3]

o pad message so its length is a multiple of 512 bits

o initialise the 5-word (160-bit) buffer (A,B,C,D,E) to

o (67452301,efcdab89,98badcfe,10325476,c3d2e1f0)

o process the message in 16-word (512-bit) chunks, using 4 rounds of 20 bit operations
each on the chunk & buffer

o output hash value is the final buffer value

xxvii) SHA is a close relative of MD5, sharing much common design, but each having differences

xxviii) SHA has very recently been subject to modification following NIST identification of some
concerns, the exact nature of which is not public

xxix) current version is regarded as secure

Digital Signature Schemes

xxx) public key signature schemes

xxxi) the private-key signs (creates) signatures, and the public-key verifies signatures

xxxii) only the owner (of the private-key) can create the digital signature, hence it can be used to
verify who created a message

xxxiii) anyone knowing the public key can verify the signature (provided they are confident of the
identity of the owner of the public key - the key distribution problem)

xxxiv) usually don't sign the whole message (doubling the size of information exchanged), but just
a hash of the message
xxxv) digital signatures can provide non-repudiation of message origin, since an asymmetric
algorithm is used in their creation, provided suitable timestamps and redundancies are incorporated
in the signature

RSA
xxxvi) RSA encryption and decryption are commutative, hence it may be used directly as a digital
signature scheme

o given an RSA scheme {(e,R), (d,p,q)}

xxxvii) to sign a message, compute:

o S = Md(mod R)

xxxviii) to verify a signature, compute:

o M = Se(mod R) = Me.d(mod R) = M(mod R)

xxxix) thus know the message was signed by the owner of the public-key

xl) would seem obvious that a message may be encrypted, then signed using RSA without
increasing it size

o but have blocking problem, since it is encrypted using the receivers modulus, but
signed using the senders modulus (which may be smaller)

o several approaches possible to overcome this

xli) more commonly use a hash function to create a separate MDC which is then signed

El Gamal Signature Scheme

xlii) whilst the ElGamal encryption algorithm is not commutative, a closely related signature
scheme exists

xliii) El Gamal Signature scheme

xliv) given prime p, public random number g, private (key) random number x, compute

o y = gx(mod p)

xlv) public key is (y,g,p)

o nb (g,p) may be shared by many users

o p must be large enough so discrete log is hard

xlvi) private key is (x)

xlvii) to sign a message M

o choose a random number k, GCD(k,p-1)=1

o compute a = gk(mod p)

o use extended Euclidean (inverse) algorithm to solve

o M = x.a + k.b (mod p-1)

o the signature is (a,b), k must be kept secret

o (like ElGamal encryption is double the message size)

xlviii) to verify a signature (a,b) confirm:

o ya.ab(mod p) = gM(mod p)

Example of ElGamal Signature Scheme

xlix) given p=11, g=2

l) choose private key x=8

li) compute

o y = gx(mod p) = 28(mod 11) = 3

lii) public key is y=3,g=2,p=11)

liii) to sign a message M=5

o choose random k=9

o confirm gcd(10,9)=1

o compute

▪
a = gk(mod p) = 29(mod 11) = 6
o solve

▪
M = x.a+k.b(mod p-1)

▪
5 = 8.6+9.b(mod 10)

▪
giving b = 3

o signature is (a=6,b=3)

liv) to verify the signature, confirm the following are correct:

o ya.ab(mod p) = gM(mod p)

o 36.63(mod 11) = 25(mod 11)

DSA (Digital Signature Algorithm)

lv) DSA was designed by NIST & NSA and is the US federal standard signature scheme (used
with SHA hash alg)

o DSA is the algorithm, DSS is the standard

o There was considerable reaction to its announcement!

▪
debate over whether RSA should have been used

▪
debate over the provision of a signature only alg

lvi) DSA is a variant on the ElGamal and Schnorr algorithms

lvii) description of DSA

o p = 2L a prime number, where L= 512 to 1024 bits and is a multiple of 64

o q a 160 bit prime factor of p-1

o g = h(p-1)/q where h is any number less than p-1 with h(p-1)/q(mod p)> 1

o x a number less than q

o y = gx(mod p)

lviii) to sign a message M

o generate random k, k<q

o compute

▪
r = (gk(mod p))(mod q)

▪
s = k-1.SHA(M)+ x.r (mod q)

o the signature is (r,s)

lix) to verify a signature:

o w = s-1(mod q)

o u1= (SHA(M).w)(mod q)

o u2= r.w(mod q)

o v = (gu1.yu2(mod p))(mod q)

o if v=r then the signature is verified

lx) comments on DSA

o was originally a suggestion to use a common modulus, this would make a tempting
target, discouraged

o it is possible to do both ElGamal and RSA encryption using DSA routines, this was
probably not intended :-)

o DSA is patented with royalty free use, but this patent has been contested, situation
unclear

o Gus Simmons has found a subliminal channel in DSA, could be used to leak the
private key from a library - make sure you trust your library implementer