Cryptographic hash functions are an important tool in cryptography to achieve certain security goals such as authenticity, digital signatures, digital time stamping, and entity authentication. They are also strongly related to other important cryptographic tools such as block ciphers and pseudorandom functions. The standard and widely used hash functions such as MD5 and SHA-1 follow the design principle of Merkle-Damgard iterated hash function construction which was presented independently by Ivan Damgard and Ralph Merkle at Crypto'89. It has been established that neither these hash functions nor the Merkle-Damgard construction itself meet certain security requirements. This thesis aims to study the attacks on this popular construction and propose schemes that offer more resistance against these attacks as well as investigating alternative approaches to the Merkle-Damgard style of designing hash functions. This thesis aims at analysing the security of the standard hash function Cellular Authentication and Voice Encryption Algorithm (CAVE) used for authentication and key-derivation in the second generation (2G) North American IS-41 mobile phone system. In addition, this thesis studies the analysis issues of message authentication codes (MACs) designed using hash functions. With the aim to propose some efficient and secure MAC schemes based on hash functions.



This thesis works on three aspects of hash functions: design, cryptanalysis and applications with the following significant contributions:



* Proposes a family of variants to the Damgard-Merkle construction called 3CG for better protection against specific and generic attacks. Analysis of the linear variant of 3CG called 3C is presented including its resistance to some of the known attacks on hash functions.



* Improves the known cryptanalytical techniques to attack 3C and some other similar designs including a linear variant of GOST, a Russian standard hash function.



* Proposes a completely novel approach called Iterated Halving, alternative to the standard block iterated hash function construction.



* Analyses provably secure HMAC and NMAC message authentication codes (MACs) based on weaker assumptions than stated in their proofs of security. Proposes an efficient variant for NMAC called NMAC-1 to authenticate short messages. Proposes a variant for NMAC called M-NMAC which offers better protection against the complete key-recovery attacks than NMAC. As well it is shown that M-NMAC with hash functions also resists side-channel attacks against which HMAC and NMAC are vulnerable. Proposes a new MAC scheme called O-NMAC based on hash functions using just one secret key.



* Improves the open cryptanalysis of the CAVE algorithm.



* Analyses the security and legal implications of the latest collision attacks on the widely used MD5 and SHA-1 hash functions.

Cryptographic hash functions : cryptanalysis, design and applications

In this paper, we give a fast attack against hash function—HAVAL-128. HAVAL was presented by Y. L. Zheng et al. at Auscrypto’92. It can be processed in 3, 4 or 5 passes, and produces 128, 160, 192, or 224-bit fingerprint. We break the HAVAL with 128-bit fingerprint. The conclusion is that, given any 1024-bit message m, we just make some modifications about m, and the modified message m can collide with another message m′ only with probability 1/27, where m′=m+Δm, in which Δm is a fixed difference selected in advance. In addition, two collision examples for HAVAL-128 are given in this paper.

An attack on hash function HAVAL-128

Statistical randomness testing has significant importance in analyzing the quality of random number generators. In this study, we focus on the independence of randomness tests and its effect on the coverage of test suites. We experimentally observe that frequency, overlapping template, longest run of ones, random walk height and maximum order complexity tests are correlated for short sequences. We also proposed the concept of sensitivity, where we analyze the effect of simple transformations on output p-values. We claim that whenever the effect is significant, the composition of the transformation and the test may be included to the suite as a new test.

On Independence and Sensitivity of Statistical Randomness Tests

Synchronous stream ciphers produce long keystreams to be XORed with plaintext. The output keystreams should be indistinguishable from truly random sequences and should not leak any information about the secret key and the internal state of the cipher. In this study, we propose six new statistical tests to evaluate the randomness properties of synchronous stream ciphers. We applied four of these tests to the ciphers presented to ECRYPT and tabulated the results.

/pdf/on-statistical-analysis-of-synchronous-stream-ciphers-227c5jfr24.pdf

On statistical analysis of synchronous stream ciphers

Let a partial deterministic finite automaton be a DFA in which each state need not have a transition edge for each letter of the alphabet. We demonstrate that the smallest partial DFA for the set of all subwords of a given word w, Iwl>2, has at most 21w(-2 states and 3(wl-4 transition edges, independently of the alphabet size. We give an algorithm to build this smallest partial DFA from the input w on-line in linear time.

The Smallest Automaton Recognizing the Subwords of a Text ; CU-CS-300-84

Cryptographic hash functions are important cryptographic primitives and are used extensively in cryptographic applications. One such family of hash functions is the MD4 family. This family includes hash functions such as MD5, SHA-1 and RIPEMD-160. In 1995 an attack on the full compress function of MD4 was presented by Dobbertin. This paper builds on the work presented by Dobbertin. The attack of Dobbertin consists out of two components. The first component requires that a solution to a set of nonlinear equations be found. This paper presents an algorithm which reduces the number of trials required for finding a solution to these nonlinear equations. This algorithm is approximately 64 times faster than the technique proposed by Dobbertin. This implies a significant reduction in the effort required for finding collisions for MD4.

A fast attack on the MD4 hash function

The maximum order complexity determines the shortest feedback shift register which can generate a given sequence utilising a memoryless, possibly non-linear, feedback function. The maximum order complexity of a sequence is a potentially useful measure of the randomness of 8 sequence. In this paper a statistical test based on the maximum order complexity is proposed. The proposed test requires that the distribution of the maximum order complexity of a random sequence of arbitrary length is known. Erdmann and Murphy (1997) derived an expression which approximates the distribution of the maximum order complexity. Evaluating this expression is computationally expensive and an alternative approximation to the distribution of the maximum order complexity is proposed. The alternative approximation is then used to construct a computationally efficient statistical test which may be used to evaluate the randomness of a sequence. The proposed test is specifically concerned with binary sequences and the distribution of the maximum order complexity of binary sequences.

P.R. Kasselman

Papers

A fast attack on the MD4 hash function

A statistical test for stream ciphers based on the maximum order complexity