UNIT III

Authentication requirement – Authentication function – MAC –

Hash function – Security of hash function and MAC –MD5 -
SHA - HMAC –CMAC - Digital signature and authentication
protocols – DSS – EI Gamal – Schnorr.
Authentication requirement
• In the communication across networks following attacks are identified.
 Disclosure
 Not Processing the Cryptographic Key.
 Traffic analysis
 Discovery of the pattern of traffic between parties.
 Masquerade
 One entity pretends to be different entity.
 Content modification
 Changes to the contents of a message
 Sequence modification
 Any modification to a sequence of messages between parties
 Timing modification
 Delay or replay of messages.
 Source repudiation
 Denial of transmission of message by source.
 Destination repudiation
 Denial of receipt of message by destination.
Authentication requirement
• In the communication across networks following attacks are identified.

 Not Processing the Cryptographic Key.

 Discovery of the pattern of traffic between parties.

 One entity pretends to be different entity.

 Changes to the contents of a message

 Any modification to a sequence of messages between parties

 Delay or replay of messages.

 Denial of transmission of message by source.

 Denial of receipt of message by destination.
Draw mind map
2.
3.
1.

Authentication 4.
requirements
8.

5.
7. 6.
Authentication Functions
• Two levels of functionality.
 Lower Level
 A value to be used to authenticate a message.
 Higher Level
 A receiver to verify the authenticity of a message.
 Types of functions
1) Message encryption
2) Hash function
3) Message authentication code (MAC)
Authentication Functions
• Two levels of functionality.

 A value to be used to authenticate a message.
 Higher Level

 Types of functions
1)
2)
3)
Message encryption
 Message encryption by itself can provide a measure of authentication.
 The analysis differs for symmetric and public-key encryption schemes.
 Symmetric
 Symmetric Encryption provides the confidentiality and authentication.

 But this is not say that the received message are exactly sent from sender.

 It is difficult to determine the decrypt message as what sender sent.

 One solution append error detecting code or Frame Check Sequence (FCS).

 FCS and Encryption functions are performed by two ways

 Internal Error Control

 External Error Control

(b) External error control
 Public key Encryption


PUb E(PUb, M) PRb

(a) Public-key encryption: confidentiality

PRa E(PRa, M) PUa

(b) Public-key encryption: authentication and signature

PRa E(PRa, M) PUb E(PUb, E(PRa, M)) PRb E(PRa, M) PUa

Public-key encryption: confidentiality, authentication, and signature

Message Authentication Code
 A secret key to generate a small fixed-size block of data, known as a cryptographic
checksum or MAC, that is appended to the message.

 When A has a message to send to B, it calculates the MAC as a function of the

message and the key:
MAC = C(K, M)
where
M = input message
C = MAC function
K = shared secret key
MAC = message authentication code
 (a) Message authentication

(b) Message authentication and confidentiality; authentication tied to

plaintext

(c) Message authentication and confidentiality; authentication tied to

ciphertext
Hash Function
 A hash function H accepts a variable-length block of data M as input and produces
a fixed-size hash value h = H(M).

 When a hash function is used to provide message authentication, the hash function
value is often referred to as a message digest.

 The sender computes a hash value as a function of the bits in the message and
transmits both the hash value and the message.

 The receiver performs the same hash calculation on the message bits and compares
this value with the incoming hash value.

 If there is a mismatch, the receiver knows that the has been altered.
SHA
 SHA Stands for Secure Hash Algorithm.
 The first version of SHA is SHA0. The revised version of SHA is SHA1 in
1995.
 The Actual Standards are
SHA-1 SHA-224 SHA-256 SHA-384 SHA-512

Message Digest Size 160 224 256 384 512

Message Size <264 <264 <264 <2128 <2128

Block Size 512 512 512 1024 1024
Word Size 32 32 32 64 64
Number of Steps 80 64 64 80 80
SHA 512
 Input Message – Maximum length <2128 bits
 Output – 512 message digest
 Input is processed as 512 bit message digest.
 This algorithm has 5 steps
 Append padding bits.
 Append length.
 Initialize hash buffer.
 Process message in 1024-bit (128-word) blocks.
 Output.
Step 1 Append padding bits.
 The message is padded so that its length is congruent to 896 modulo 1024
[length ≡ 896(mod 1024)].
 Thus, the number of padding bits is in the range of 1 to 1024.
 The padding consists of a single 1bit followed by the necessary number of 0
bits.
Step 2 Append length.
 A block of 128 bits is appended to the message.
 It contains the length of the original message.
 The outcome of the first two steps yields a message that is an integer
multiple of 1024 bits in length.
Step 3 Initialize hash buffer.
 A 512-bit buffer is used to hold intermediate and final results of the hash
function.
 The buffer can be represented as eight 64-bit registers (a, b, c, d, e, f, g, h).
 These registers are initialized to the following 64-bit integers (hexadecimal
values):
a = 6A09E667F3BCC908 e = 510E527FADE682D1
b = BB67AE8584CAA73B f = 9B05688C2B3E6C1F
c = 3C6EF372FE94F82B g = 1F83D9ABFB41BD6B
d = A54FF53A5F1D36F1 h = 5BE0CD19137E2179
Step 4 Process message in 1024-bit (128-word) blocks.
 The Heart of the algorithm is module it has 80 rounds.
 Each round takes as input
 512-bit buffer value, abcdefgh
 1024-bit block being processed (Mi)
 constant Kt where 0 … t … 79 indicates one of the 80 rounds
 The output of the eightieth round is added to the input to the first round (Hi-
1) to produce Hi.
Step 5 Output
 The output from the Nth stage is the 512-bit message digest.
We can summarize the behavior of SHA-512 as follows:
H0 = IV
Hi = SUMi-1 (Hi-1, abcdefghi)
MD = HN
where
IV = initial value of the abcdefgh buffer, defined in step 3 abcdefghi = the
output of the last round of processing of the ith message block
N = the number of blocks in the message (including padding and length
fields)
SUM64 = addition modulo 264 performed separately on each word of the pair
of inputs
MD = final message digest value
SHA 512 – Round Function
SHA 512 – Round Function
Word Generation
MD5
 MD5 Stands for Message Digest Version 5.
 designed by Ronald Rivest (the “R” in RSA)
 Latest in a series of MD2, MD5
 Produces a 128-bit hash value
 Until recently was the most widely used hash algorithm
 in recent times have both brute-force & cryptanalytic concerns
MD5 LOGIC
 Input – 512 bits Block Size
 Output – 128 bit md value
 Step 1 Append Padding Bits
The message is padded so that the length is congruent to 448 mod 512.
The padded consists of 1bit followed by zero.
 Step 2 Append Length
The 64 bit representation length of the original message is append to padded bits.
 Step 3 Initialize MD Buffer
A buffer has 4 Registers (A,B,C,D)
32 bit
A = 67452301
B = EFCDAB89
C = 98BADCFE
D = 10325476
Step 4 Process Message in 512 bit.
using 4 rounds of 16 bit operations on message block & buffer
add output to buffer input to form new buffer value
 Output 128 bit MD
We can summarize the behaviour of MD5 as follows:
CV0 = IV
CVq+1 = SUM32(CVq,RFI[Yq,RFH[Yq,RFG[Yq,RFF[Yq,CVq]]]])
MD = CVL

where

IV - initial value of the ABCD buffer, defined in step 3

Yq - the qth 512-bit block of the message

L - the number of blocks in the message (including padding and length fields)

CVq - chaining variable processed with the qth block of the message

RFx - round function using primitive logical function x

MD- final message digest value

SUM32 - addition modulo 232 performed separately on each word of the pair of

inputs
MD5 Compression Function

33
MD5 Compression Function
Each round has 16 steps of the form:
a = b+((a+g(b,c,d)+X[k]+T[i])<<<s)
a,b,c,d refer to the 4 words of the buffer, but used in varying permutations
note this updates 1 word only of the buffer
after 16 steps each word is updated 4 times
where
g(b,c,d) - different nonlinear function in each round (F,G,H,I)
T[i] - ith entry in the matrix of constants T
<<<s - Circular left shift
+ - addition modulo

34
ROUND Primitive Function G(b.c.d)

1. F(b,c,d) (b˄c)˅(b˄d)

2. G(b,c,d) (c˄d)˅(c˄d)

3. H(b,c,d) b⊕c⊕d

4. I(b,c,d) c⊕(b˄d)
MD5 VS SHA
 Brute force attack is harder (160 vs 128 bits for MD5)
 Not vulnerable to any known attacks (compared to
MD4/5)
 A little slower than MD5 (80 vs 64 steps)
 Both designed as simple and compact
 Optimised for big endian CPU's (vs MD5 which is
optimised for little endian CPU’s)
MAC Based Hash Function : HMAC
HMAC Design Objectives
To use, without modifications, available hash functions which are free in use.

To allow for easy replaceability of the embedded hash function

To preserve the original performance of the hash function
To use and handle keys in a simple way.

 HMAC Executes Approximately same time taken for hash function.

HMAC adds three executions of the hash compression function (for Si, So, and the block
produced from the inner hash).
+

⊕
HMAC Algorithm
H = embedded hash function (e.g., MD5, SHA-1, RIPEMD-160)
IV = initial value input to hash function
M = message input to HMAC (including the padding specified in the
embedded hash function)
Yi = i th block of M, 0 ≤ i ≤ (L - 1)
L = number of blocks in M
b = number of bits in a block
n = length of hash code produced by embedded hash function
K = secret key; recommended length is Ú n; if key length is greater than b,
the key is input to the hash function to produce an n-bit key
K+ = K padded with zeros on the left so that the result is b bits in length
ipad = 00110110 (36 in hexadecimal) repeated b/8 times
opad = 01011100 (5C in hexadecimal) repeated b/8 times
Algorithm Expression
 HMAC(K, M) = H[(K + ⊕ opad) || H[(K + ⊕ ipad) || M]]
Algorithm Description
1. Append zeros to the left end of K to create a b-bit string K+ (e.g., if K is of
length 160 bits and b = 512, then K will be appended with 44 zeroes).
2. XOR (bitwise exclusive-OR) K + with ipad to produce the b-bit block Si.
3. Append M to Si.
4. Apply H to the stream generated in step 3.
5. XOR K + with opad to produce the b-bit block So.
6. Append the hash result from step 4 to So.
7. Apply H to the stream generated in step 6 and output the result.
Algorithm Compression
 A more efficient implementation is possible,
f(IV, (K+ ⊕ ipad))
f(IV, (K+ ⊕ opad))
Security of HMAC

 An attack on this hash function requires either a brute-force attack on the key.

 The attacker is looking for two messages M and M′ that produce the same

hash: H(M) = H(M′). This is the birthday attack.

+

⊕
Cipher-Based Message Authentication Code
(CMAC)
 Messages of one fixed length of mn bits are processed, where n is the cipher
block size and m is a fixed positive integer.
 Three keys are used :
 One key K of length k to be used at each step of the cipher block chaining
 Two keys of length b, where b is the cipher block length.
 The operation of CMAC when the message is an integer multiple n of the
cipher block length b.
 The message is divided into n blocks (M1, M2, …, Mn).
 The algorithm makes use of a k-bit encryption key K and a b-bit constant, K1.
 CMAC is calculated as follows
C1 = E(K, M1)
C2 = E(K, [M2⊕ C1])
C3 = E(K, [M3⊕ C2])
.
.
.
Cn = E(K, [Mn⊕ Cn-1 ⊕ K1])
T = MSBTlen (Cn)
Where
T = Message authentication code also referred as Tag
Tlen = Bit length of T
MSB(x) = The s leftmost bits of the bit string
 If the message is not an integer multiple of the cipher block length, then the
final block is padded to the right (least significant bits) with a 1 and as many 0s
as necessary so that the final block is also of length b.
 The CMAC operation then proceeds as before, except that a different b-bit key
K2.
The two b-bit keys are derived from the k-bit encryption key as follows.
L = E(K, 0b )
K1 = L . x
K2 = L . x2 = (L . x) . x

where multiplication ( . ) is done in the finite field GF(2b ) and x and x2 are first
and second-order polynomials that are elements of GF(2b).
(b) Message length is not integer multiple of block size
DIGITAL SIGNATURE
 Digital signatures are the public-key primitives of message authentication.
 A digital signature is a technique that binds a person/entity to the digital data
 This binding can be independently verified by receiver as well as any third
party.
 Digital signature is a cryptographic value that is calculated from the data and a
secret key known only by the signer.
PROPERTIES
 It must verify the author and the date and time of the signature.
 It must authenticate the contents at the time of the signature.
 It must be verifiable by third parties, to resolve disputes.
 Destination
Destination BB

(a) E(PRa, H(M))

a
(b)

Figure 11.4 Simplified Examples of Digital Signatures

1.
ELGAMAL DIGITAL SIGNATURE SCHEME
 The Elgamal signature scheme involves the use of the private key for
encryption and the public key for decryption.
 Elgamal encryption, the global elements of Elgamal digital signature are a
prime number q and a, which is a primitive root of q.
 User A generates a private/public key pair as follows.
1.Generate a random integer XA, such that 1 < X < q - 1.
2.Compute YA = aXA mod q.
3.A’s private key is XA; A’s pubic key is {q, a, YA}.
To sign a message M,
user A first computes the hash m = H(M)
1.Choose a random integer K such that 1≤ K ≤ q - 1 and gcd(K, q - 1) = 1.
That is, K is relatively prime to q - 1.
2.Compute S1 = aK mod q.
3.Compute K-1 mod (q - 1). That is, compute the inverse of K modulo q - 1.
4.Compute S2 = K-1 (m - XA S1) mod (q - 1).
5.The signature consists of the pair (S1, S2).
Any user B can verify the signature as follows.
1. Compute V1 = am mod q.
2. Compute V2 = (YA)S1 (S1)S2 mod q.
The signature is valid if V1 = V2.
SCHNORR DIGITAL SIGNATURE SCHEME
 The Schnorr signature scheme is based on discrete logarithms.
 The Schnorr scheme minimizes the message-dependent amount of computation
required to generate a signature.
 The scheme is based on using a prime modulus p, with p - 1 having a prime factor q
of appropriate size;
p - 1 ≡ (mod q).
 p is a 1024-bit number, and q is a 160-bit number.
 The first part of this scheme is the generation of a private/public key pair
1) Choose primes p and q, such that q is a prime factor of p - 1.
2)Choose an integer a, such that aq = 1 mod p. The values a, p, and q comprise a
global public key that can be common to a group of users.
3)Choose a random integer s with 0 < s < q. This is the user’s private key.
4)Calculate v = a-s mod p. This is the user’s public key.
A user with private key s and public key v generates a signature as follows.
1. Choose a random integer r with 0 < r < q and compute x = ar mod p.
2. Concatenate the message with x and hash the result to compute the value e:
e = H(M || x)
3.Compute y = (r + se) mod q. The signature consists of the pair (e, y).
Any other user can verify the signature as follows.
1. Compute x′ = ay ve mod p.
2. Verify that e = H(M || x′).

Hence H(M||x′) = H(M||x) .

A user with private key s and public key v generates a signature as follows.
1. Choose a random integer r with 0 < r < q and compute x = ar mod p.
2. Concatenate the message with x and hash the result to compute the value e:
e = H(M || x)
3.Compute y = (r + se) mod q. The signature consists of the pair (e, y).
Any other user can verify the signature as follows.
1. Compute x′ = ay ve mod p.
2. Verify that e = H(M || x′).

Hence H(M||x′) = H(M||x) .