CRYPTOGRAPHIC

HASH FUNCTIONS
Mukesh Chinta
ASST PROFESSOR, CSE
VRSEC
 ❖ A hash function H accepts a variable-length block of data as input and produces a
fixed-size hash value h = H(M) with the principal objective of maintaining Data
Integrity.

❖ The kind of hash function needed for security applications is referred to as a

cryptographic hash function.

❖ A cryptographic hash function is an algorithm for which it is computationally

infeasible to find either
▪ (a) a data object that maps to a pre-specified hash result (the one-way property)
▪ (b) two data objects that map to the same hash result (the collision-free property).

Because of these characteristics, hash functions are often used

to determine whether or not data has changed

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security 2

 APPLICATIONS OF CRYPTOGRAPHIC HASH FUNCTIONS

❖ Message authentication is a mechanism or service used to verify the integrity of a message.

Message authentication assures that data received are exactly as sent (i.e., contain no
modification, insertion, deletion, or replay).
❖ When a hash function is used to provide message authentication, the hash function value is
often referred to as a message digest.
❖ A hash code can be used to provide message authentication in many ways.
3

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Authentication

Authentication
4
without
encryption!!!

Authentication & Confidentiality

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 ▪ Message authentication is achieved using a message authentication code (MAC), also known
as a keyed hash function.

▪ Typically, MACs are used between two parties that share a secret key to authenticate information
exchanged between those parties.

▪ A MAC function takes as input a secret key and a data block and produces a hash value, referred
to as the MAC. This can then be transmitted with or stored with the protected message.
5

▪ If the integrity of the message needs to be checked, the MAC function can be applied to the
message and the result compared with the stored MAC value. An attacker who alters the
message will be unable to alter the MAC value without knowledge of the secret key. The
verifying party also knows who the sending party is because no one else knows the secret key.

▪ E(K,H(M)) is a function of a variable-length message and a secret key , and it produces a fixed-
size output that is secure against an opponent who does not know the secret key.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 APPLICATIONS OF CRYPTOGRAPHIC HASH FUNCTIONS

The operation of the digital signature is similar to that of the MAC. In the case of the digital signature, the
hash value of a message is encrypted with a user’s private key. Anyone who knows the user’s public key can
verify the integrity of the message that is associated with the digital signature.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 REQUIREMENTS AND SECURITY
➢ A fixed-length hash value h is generated by a function H that takes as input a message of arbitrary length:
h=H(M).
➢ For a hash value h = H(x), we say x that is the preimage of h. That is, x is a data block whose hash function,
using the function H, is h.
➢ A collision occurs if we have x ≠ y and H(x) = H(y). As hash functions are used for data integrity, collisions are
undesirable.
The purpose of a hash function is to
produce a “fingerprint” of a file,
message, or other block of data. To
be used for message authentication,
the hash function H must have the
properties shown:
MESSAGE AUTHENTICATION
CODES
 A Message authentication code (MAC) is an algorithm that requires the use of a secret key. A MAC
takes a variable-length message and a secret key as input and produces an authentication code. A
recipient in possession of the secret key can generate an authentication code to verify the integrity of
the message.
Following attacks can be identified in now a days communication:
1. Disclosure
2. Traffic Analysis
3. Masquerade
4. Content Modification 9

5. Sequence Modification
6. Timing Modification
7. Source Repudiation
8. Destination Repudiation
❖ Measures to deal with the first two attacks are in the realm of message confidentiality.
❖ Measures to deal with items (3) through (6) in the foregoing list are generally regarded as message
authentication.
❖ Mechanisms for dealing specifically with item (7) come under the scope of digital signatures.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Message Authentication Functions

Message authentication is a procedure to verify that received messages come from the alleged source
and have not been altered. Message authentication may also verify sequencing and timeliness. It is
intended against the attacks like content modification, sequence modification, timing modification and
repudiation.

There are three classes by which different types of functions that may be used to produce an
authenticator.
10
Message encryption–the ciphertext serves as authenticator
Message authentication code (MAC)–a public function of the message and a secret key producing
a fixed-length value to serve as authenticator. This does not provide a digital signature because A
and B share the same key.
Hash function–a public function mapping an arbitrary length message into a fixed-length hash
value to serve as authenticator. This does not provide a digital signature because there is no key.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Securityc

 11
Message Encryption
Message encryption by itself can provide a measure of authentication. The analysis differs for conventional and public-key
encryption schemes
 Often one needs alternative authentication schemes than just encrypting the message.
➢ Sometimes one needs to avoid encryption of full messages due to legal requirements.
➢ Encryption and authentication may be separated in the system architecture.

An opponent could achieve a certain level of disruption simply by issuing messages with random content
purporting to come from a legitimate user. To counter such attacks, append an error-detecting code, also known as
a frame check sequence (FCS) or checksum, to each message before encryption.

12

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Message Authentication Code
An alternative authentication technique involves the use of a secret key to generate a small fixed-size block of
data, known as cryptographic checksum or MAC, which is appended to the message. This technique assumes that
both the communicating parties say A and B share a common secret key K. When A has a message to send to B, it
calculates MAC as a function C of key and message given as: MAC=Ck(M)

The message and the MAC are transmitted to the intended recipient, who upon receiving performs
the same calculation on the received message, using the same secret key to generate a new MAC. The
received MAC is compared to the calculated MAC and only if they match, then: 13
▪ The receiver is assured that the message has not been altered: Any alternations been done the
MAC’s do not match.
▪ The receiver is assured that the message is from the alleged sender: No one except the sender has
the secret key and could prepare a message with a proper MAC.
▪ If the message includes a sequence number, then receiver is assured of proper sequence as an
attacker cannot successfully alter the sequence number

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Basic Uses of a Message Authentication Code

14

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Scenarios for MAC Usage
⁂ A MAC function is similar to encryption. One difference is that the MAC algorithm need not be
reversible, as it must be for decryption. In general, the MAC function is a many-to-one function.
⁂ It turns out that, because of the mathematical properties of the authentication function, it is less
vulnerable to being broken than encryption
➢ If a message is broadcast to several destinations in a network (such as a military control center), then it is
cheaper and more reliable to have just one node responsible to evaluate the authenticity –message will be sent
in plain with an attached authenticator.
➢ If one side has a heavy load, it cannot afford to decrypt all messages –it will just check the authenticity of
15
some randomly selected messages.
➢ Authentication of computer programs in plaintext is very attractive service as they need not be decrypted
every time wasting of processor resources. Integrity of the program can always be checked by MAC.
➢ For some applications, it may not be of concern to keep messages secret, but it is important to authenticate
messages. An example is the Simple Network Management Protocol Version 3 (SNMPv3).
➢ Separation of authentication and confidentiality functions affords architectural flexibility.
➢ A user may wish to prolong the period of protection beyond the time of reception and yet allow processing of
message contents

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Requirements of a MAC Function
➢ If an opponent observes M and MAC(K,M), it should be computationally infeasible for the
opponent to construct a message M' such that
MAC(K, M') = MAC(K, M)
➢ MAC(K,M) should be uniformly distributed in the sense that for randomly chosen messages, M and
M', the probability that is MAC(K,M) = MAC(K,M') is 2-n, where n is the number of bits in the tag.

➢ Let M' be equal to some known transformation on M. That is M' = f(M),. For example, f may
involve inverting one or more specific bits. In that case,
16
Pr [MAC(K, M) = MAC(K, M')] = 2-n
❖ The first requirement states a scenario, in which an opponent is able to construct a new message to
match a given tag, even though the opponent does not know and does not learn the key.
❖ The second requirement deals with the need to thwart a brute-force attack based on chosen
plaintext.
❖ The final requirement dictates that the authentication algorithm should not be weaker with respect
to certain parts or bits of the message than others

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Limitations of a MAC Function
There are two major limitations of MAC, both due to its symmetric nature of operation −
Establishment of Shared Secret.
➢ It can provide message authentication among pre-decided legitimate users who have shared
key. This requires establishment of shared secret prior to use of MAC.
Inability to Provide Non-Repudiation
➢ Non-repudiation is the assurance that a message originator cannot deny any previously sent
17
messages and commitments or actions.
➢ MAC technique does not provide a non-repudiation service. If the sender and receiver get
involved in a dispute over message origination, MACs cannot provide a proof that a message
was indeed sent by the sender.
➢ Though no third party can compute the MAC, still sender could deny having sent the message
and claim that the receiver forged it, as it is impossible to determine which of the two parties
computed the MAC.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Message-Digest algorithms characteristics
Message-Digest (Fingerprint) algorithms are special functions which transform input of (usually) arbitrary length into
output (so-called "fingerprint" or "message digest") of constant length. These transformation functions must fulfil these
requirements:
▪ no one should be able to produce two different inputs for which the transformation function returns the same output
▪ no one should be able to produce input for given prespecified output
MD2, MD4 and MD5 are message-digest algorithms developed by Ronald L. Rivest. All these
three algorithms take input message of arbitrary length and produce a 128-bit message
digest.
MD2 - developed in 1989 (description available in Internet RFC 1319)
The message is first padded so its length in bytes is divisible by 16. A 16-byte checksum is then appended to the message, and the
hash value is computed on the resulting message. MD2 was optimized for 8-bit machines, whereas MD4 and MD5 were aimed at 32- 18

bit machines.
MD4 - developed in 1990 (description available in Internet RFC 1320)
The message is padded to ensure that its length in bits plus 64 is divisible by 512. A 64-bit binary representation of the original length
of the message is then concatenated to the message. The message is processed in 512-bit blocks in the Damgard/Merkle iterative
structure, and each block is processed in three distinct rounds.
MD5 - developed in 1991 (description available in Internet RFC 1321)
It is basically MD4 with "safety-belts" and while it is slightly slower than MD4, it is more secure. The algorithm consists of four
distinct rounds, which has a slightly different design from that of MD4. Message-digest size, as well as padding requirements, remain
the same.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

The MD5 message-digest algorithm takes as input, a message of arbitrary length and produces as output, a 128-
bit message digest. The input is processed in 512-bit blocks. The processing consists of the following steps:
1. Append Padding bits: The message is padded so that its length in bits is congruent to 448 modulo 512 i.e. the
length of the padded message is 64 bits less than an integer multiple of 512 bits. Padding is always added, even if
the message is already of the desired length. Padding consists of a single 1-bit followed by the necessary number
of 0-bits.
2. Append length: A 64-bit representation of the length in bits of the original message (before the padding) is
appended to the result of step-1. If the length is larger than 264, the 64 least representative bits are taken.
3. Initialize MD buffer: A 128-bit buffer is used to hold intermediate and final results of the hash function. The
buffer can be represented as four 32-bit registers (A, B, C, D) and are initialized with A=0x01234567,
B=0x89ABCDEF, C=0xFEDCBA98, D=0x76543210 i.e. 32-bit integers (hexadecimal values).

19
4. Process Message in 512-bit (16-word) blocks: The heart of algorithm is the compression function that consists of four
rounds of processing and this module is labeled HMD5. The four rounds have a similar structure, but each uses a different
primitive logical function, referred to as F, G, H and I in the specification. Each block takes as input the current 512-bit block
being processed Yq and the 128-bit buffer value ABCD and updates the contents of the buffer. Each round also makes use of
one-fourth of a 64-element table T[1….64], constructed from the sine function. The ith element of T, denoted T[i], has the
value equal to the integer part of 232 * abs(sin(i)), where i is in radians. As the value of abs(sin(i)) is a value between 0 and 1,
each element of T is an integer that can be represented in 32-bits and would eliminate any regularities in the input data. The
output of fourth round is added to the input to the first round (CVq) to produce CVq+1. The addition is done independently for
each of the four words in the buffer with each of the corresponding words in CVq, using addition modulo 232.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

20
 5) Output: After all L, 512-bit blocks have been processed, the
output from the Lth stage is the 128-bit message digest. MD5 can
be summarized as follows:
CV0 = IV
CVq+1 = SUM32(CVq, RFIYqRFH[Yq, RFG[Yq,RFF[Yq,CVq]]]])
MD = CVL
Where,
IV = initial value of ABCD buffer, defined in step 3.
Yq = the qth 512-bit block of the message
L = the number of blocks in the message
CVq = chaining variable processed with the qth block of the
message.
RFx = round function using primitive logical function x.
MD = final message digest value
SUM32 = Addition modulo 232 performed separately.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security 21

 MD5 Compression Function

Each round consists of a sequence of 16 steps

operating on the buffer ABCD. Each step is of the form,
a = b+((a+g(b,c,d)+X[k]+T[i])<<<s)
where a, b, c, d refer to the four words of the buffer
but used in varying permutations. After 16 steps, each
word is updated 4 times. g(b,c,d) is a different
nonlinear function in each round (F,G,H,I).
22
The primitive function g of the F,G,H,I is given as:

Where the logical operators (AND, OR, NOT, XOR) are

represented by the symbols (, , ~, ) MD5 operation of a single step

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Each round mixes the buffer input with the next "word" of the message in a complex, non-
linear manner. A different non-linear function is used in each of the 4 rounds (but the same
function for all 16 steps in a round). The 4 buffer words (a,b,c,d) are rotated from step to step so
all are used and updated. g is one of the primitive functions F,G,H,I for the 4 rounds
respectively. X[k] is the kth 32-bit word in the current message block. T[i] is the ith entry in the
matrix of constants T. The addition of varying constants T and the use of different shifts helps
ensure it is extremely difficult to compute collisions.
23
The array of 32-bit words X[0..15] holds the value of current 512-bit input block being
processed. Within a round, each of the 16 words of X[i] is used exactly once, during one step.
The order in which these words is used varies from round to round. In the first round, the words
are used in their original order. For rounds 2 through 4, the following permutations are used
❖2(i) = (1 + 5i) mod 16
❖3(i) = (5 + 3i) mod 16
❖4(i) = 7i mod 16

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

for i from 0 to 63 K[i] := floor(232 × abs(sin(i + 1)))
K[ 0.. 3] := { 0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee }
K[ 4.. 7] := { 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501 }
K[ 8..11] := { 0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be }
K[12..15] := { 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821 }
K[16..19] := { 0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa }
K[20..23] := { 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8 }
K[24..27] := { 0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed }
K[28..31] := { 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a }
K[32..35] := { 0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c }
K[36..39] := { 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70 }
K[40..43] := { 0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05 }
K[44..47] := { 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665 }
K[48..51] := { 0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039 }
K[52..55] := { 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1 }
K[56..59] := { 0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1 }
K[60..63] := { 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391 }

//s specifies the per-round shift amounts

s[ 0..15] := { 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22 }
s[16..31] := { 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20 }
s[32..47] := { 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23 }
s[48..63] := { 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21 }
Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security
24
 Security of MD5
▪ In 2004 it was shown that MD5 is not collision resistant. As such, MD5 is not suitable
for applications like SSL certificates or digital signatures that rely on this property for
digital security.

▪ Also in 2004 more serious flaws were discovered in MD5, making further use of the
algorithm for security purposes questionable. Specifically, a group of researchers
described how to create a pair of files that share the same MD5 checksum.

▪ Further advances were made in breaking MD5 in 2005, 2006, and 2007.

▪ In December 2008, a group of researchers used this technique to fake SSL certificate
validity, and CMU Software Engineering Institute now says that “MD5 should be
considered cryptographically broken and unsuitable for further use"

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Secure Hash Algorithm
• The Secure Hash Algorithm (SHA) was developed by the National Institute of
Standards and Technology (NIST) and published as a federal information
processing standard (FIPS 180) in 1993; a revised version was issued as FIPS 180-1 26

in 1995 and is generally referred to as SHA-1.

• SHA-1 produces a hash value of 160 bits. In 2002, NIST produced a revised
version of the standard, FIPS 180-2, that defined three new versions of SHA, with
hash value lengths of 256, 384, and 512 bits, known as SHA-256, SHA-384, and
SHA-512.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 27

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

➢ The algorithm takes as input a message with a maximum length of less than 264 bits and produces as output a
160-bit message digest.
➢ The input is processed in 512-bit blocks. The overall processing of a message follows the structure of MD5 with
block length of 512 bits and a hash length and chaining variable length of 160 bits.
The processing consists of following steps:
Append Padding Bits: The message is padded so that length is congruent to 448 modulo 512; padding always
added –one bit 1 followed by the necessary number of 0 bits.
Append Length: a block of 64 bits containing the length of the original message is added.
Initialize MD buffer: A 160-bit buffer is used to hold intermediate and final results on the hash function. This
is formed by 32-bit registers A,B,C,D,E. Initial values: A=0x67452301, B=0xEFCDAB89, C=0x98BADCFE,
D=0x10325476, E=C3D2E1F0. Stores in big-endian format i.e. the most significant bit in low address.
Process message in blocks 512-bit (16-word) blocks: The processing of a single 512-bit block is shown. It
consists of four rounds of processing of 20 steps each. These four rounds have similar structure, but uses a
different primitive logical function, which we refer to as f1, f2, f3 and f4. Each round takes as input the current
512-bit block being processed and the 160-bit buffer value ABCDE and updates the contents of the buffer. Each
round also makes use of four distinct additive constants Kt. The output of the fourth round i.e. eightieth step is
added to the input to the first round to produce CVq+1.
28
 SHA-1 Processing of a single block

Output: After all L 512-bit blocks have been processed,

the output from the Lth stage is the 160-bit message digest.

The behavior of SHA-1 is as follows:

CV0 = IV
CVq+1 = SUM32(CVq, ABCDEq)
MD = CVL

Where,
• IV = initial value of ABCDE buffer
• ABCDEq = output of last round of processing
of qth message block
• L = number of blocks in the message
• SUM32 = Addition modulo 232
• MD = final message digest value.

29
Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security
 SHA-1 Compression Function
Each round has 20 steps which replaces the 5 buffer words.
The logic present in each one of the 80 rounds present is given as
(A,B,C,D,E) <- (E + f(t,B,C,D) + S5(A)+ Wt+ Kt), A, S30(B), C, D
Where,
A, B, C, D, E = the five words of the buffer
t = step number; 0< t < 79
f(t,B,C,D) = primitive logical function for step t
Sk = circular left shift of the 32-bit argument by k bits
Wt = a 32-bit word derived from current 512-bit input block.
Kt = an additive constant; four distinct values are used
+ = modulo additon

Each ft, 0<=t<=79, operates on three 32-bit words B, C, D

SHA shares much in common with MD4/5, but with 20 and produces a 32-bit word as output. f (B,C,D) is defined as
t

instead of 16 steps in each of the 4 rounds. Note the 4

follows: for words B, C, D,
constants are based on sqrt(2,3,5,10).
Step Number Hexadecimal Ineteger Part of Step Function Name Function Value
0  t  19 Kt = 5A827999 [230  2] ( 0  t 19) f1 = f(t,B,C,D) (B  C)  (B’  D)
20  t  39 Kt = 6ED9EBA1 [230  3] (20  t 39) f2 = f(t,B,C,D) BCD
40  t  59 Kt = 8F1BBCDC [230  5] (40  t 59) f3 = f(t,B,C,D) (B  C)  (B  D)  (C  D)
60  t  79 Kt = CA62C1D6 [230  10] (60  t 79) f4 = f(t,B,C,D) BCD 30
 Instead of just splitting the input block into 32-bit words and using them directly, SHA-1 shuffles and
mixes them using rotates & XOR’s to form a more complex input, and greatly increases the difficulty
of finding collisions. The procedure is as follows:
▪ Consider each message block as a chunk of 512 bits and break it into sixteen 32-bit big endian
words: W[i], 0 ≤ i ≤ 15
▪ Each chunk will be put through a little function that will create 80 words from the 16 current
ones, which is like a loop.
31
for i from 16 to 79
w[i]:= (w[i-3] xor w[i-8] xor w[i-14] xor w[i-16]) leftrotate 1

That means for the first time through the loop we want the words numbered= 13, 8, 2 and 0.
The next time through the loop we want words= 14, 9, 13 and 1.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Revised Secure Hash Standard
• In 2002, NIST produced a revised version of the standard, FIPS 180-2, that defined three new
versions of SHA, with hash value lengths of 256, 384, and 512 bits, known as SHA-256,
SHA-384, and SHA-512, respectively.
• Collectively, these hash algorithms are known as SHA-2. These new versions have the same
underlying structure and use the same types of modular arithmetic and logical binary
operations as SHA-1.
• A revised document was issued as FIP PUB 180-3 in 2008, which added a 224-bit version.
• The structure & detail is similar to SHA-1, hence analysis should be similar, but security
levels are rather higher.
• Since 2005, SHA-1 has not been considered secure against well-funded opponents, and since
2010 many organizations have recommended its replacement by SHA-2 or SHA-3. Microsoft,
Google, Apple and Mozilla have all announced that their respective browsers will stop
accepting SHA-1 SSL certificates by 2017.
Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security 32
 SHA-512 Logic
• The algorithm takes as input a message with a maximum length of less than
2128 bits and produces as output a 512-bit message digest. The input is
processed in 1024-bit blocks.

• Step 1: Append padding bits. The message is padded so that its length is
congruent to 896 modulo 1024 [length ≡ 896 (mod 1024)]. Padding is always
added, even if the message is already of the desired length. Thus, the number
of padding bits is in the range of 1 to 1024. The padding consists of a single
1-bit followed by the necessary number of 0-bits.

Mukesh Chinta, Asst Prof, CSE, VRSEC 33

34
 35
Figure: A message block and the digest as words
▪ Step 2: Append length. A block of 128 bits is appended to the message. This block is treated as an
unsigned 128-bit integer (most significant byte first) and contains the length of the original message
(before the padding).

▪ Step 3: Initialize hash buffer. A 512-bit buffer is used to hold intermediate and final results of the
hash function. The buffer can be represented as eight 64-bit registers (a, b, c, d, e, f, g, h). These
registers are initialized to the following 64-bit integers (hexadecimal values):
a = 6A09E667F3BCC908
36
b = BB67AE8584CAA73B
c = 3C6EF372FE94F82B
c = A54FF53A5F1D36F1
e = 510E527FADE682D1
f = 9B05688C2B3E6C1F
g = 1F83D9ABFB41BD6B
h = 5BE0CDI9137E2179

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

▪ Step 4: Process message in 1024-bit (128-word) blocks.
The heart of the algorithm is a module that consists of 80
rounds; this module is labeled F.
▪ The Compression function consists of 80 rounds
• updating a 512-bit buffer
• using a 64-bit value Wt derived from the current
message block
• and a round constant based on cube root of first 80
prime numbers
▪ Step 5: Output. After all N 1024-bit blocks have been
processed, the output from the Nth stage is the 512-bit
message digest.
We can summarize the behavior of SHA-512 as follows:
H0 = IV
Hi = SUM64(Hi-1, abcdefghi)
MD = HN
where
IV = initial value of the abcdefgh buffer, defined in step 3
abcdefghi = the output of the last round of processing of the ith message block
N = the number of blocks in the message (including padding and length fields)
SUM64 = Addition modulo 264 performed separately on each word of the pair of
inputs
MD = final message digest value
37
 SHA-512 Compression Function

Ch(e,f,g) = (e AND f) XOR (NOT e AND g)

Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c)
∑(a) = ROTR(a,28) XOR ROTR(a,34) XOR ROTR(a,39)
∑(e) = ROTR(e,14) XOR ROTR(e,18) XOR ROTR(e,41)
+ = addition modulo 264
Kt = a 64-bit additive constant
Wt = a 64-bit word derived from the current 512-bit input
block.

Each round also makes use of an additive constant Kt where 0 t 79 indicates one of the 80 rounds. These words
represent the first sixty-four bits of the fractional parts of the cube roots of the first eighty prime numbers. The
constants provide a "randomized" set of 64-bit patterns, which should eliminate any regularities in the input data.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

38
 SHA-512 Initial Values & Word Expansion

Buffer Value (in Hexadecimal) Buffer Value (in Hexadecimal)

A0 6A09E667F3BCC908 E0 510E527FADE682D1
B0 BB67AE8584CAA73B F0 9B05688C2B3E6C1F
C0 3C6EF372FE94F82B G0 1F83D9ABFB41BD6B
D0 A54FF53A5F1D36F1 H0 5BE0CD19137E2179
Table : Values of constants in message digest initialization of SHA-512

39

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

The first 16 values of Wt are taken directly from the 16 words of the current block. The
remaining values are defined as follows:

Where

ROTRn(x) = circular right shift (rotation) of the 64-bit argument x by n bits

SHRn(x) = left shift of the 64-bit argument x by n bits with padding by zeros on the right

40
The 80th prime is 409, with the cubic root (409)1/3 = 7.42291412044. Converting this number to binary with only
64 bits in the fraction part, we get

The fraction part: (6C44198C4A475817)16 41

 Example using SHA-512

ASCII characters: “abc”, which is equivalent to the following 24-bit binary string:

01100001 01100010 01100011 = 616263 in Hexadecimal

The original length is 24 bits, or a hexadecimal value of 18. The 1024-bit message block, in
hexadecimal, is

6162638000000000 0000000000000000 0000000000000000 0000000000000000

0000000000000000 0000000000000000 0000000000000000 0000000000000000
0000000000000000 0000000000000000 0000000000000000 0000000000000000
0000000000000000 0000000000000000 0000000000000000 0000000000000018

W0 = 6162638000000000 W5 = 0000000000000000
W1 = 0000000000000000 W6 = 0000000000000000
W2 = 0000000000000000 W7 = 0000000000000000
W3 = 0000000000000000 W8 = 0000000000000000
W4 = 0000000000000000 W9 = 0000000000000000
W10 = 0000000000000000 W13 = 0000000000000000
W11 = 0000000000000000 W14 = 0000000000000000
W12 = 0000000000000000 W15 = 0000000000000018
September 22, 2023

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security 42

 Example using SHA-512

The following table shows the initial values of these variables and their values after each of the first
two rounds.

a 6a09e667f3bcc908 f6afceb8bcfcddf5 1320f8c9fb872cc0

b bb67ae8584caa73b 6a09e667f3bcc908 f6afceb8bcfcddf5
c 3c6ef372fe94f82b bb67ae8584caa73b 6a09e667f3bcc908
d a54ff53a5f1d36f1 3c6ef372fe94f82b bb67ae8584caa73b
43
e 510e527fade682d1 58cb02347ab51f91 c3d4ebfd48650ffa
f 9b05688c2b3e6c1f 510e527fade682d1 58cb02347ab51f91
g 1f83d9abfb41bd6b 9b05688c2b3e6c1f 510e527fade682d1
h 5be0cd19137e2179 1f83d9abfb41bd6b 9b05688c2b3e6c1f

The process continues through 80 rounds. The output of the final round is

73a54f399fa4b1b2 10d9c4c4295599f6 d67806db8b148677 654ef9abec389ca9

d08446aa79693ed7 9bb4d39778c07f9e 25c96a7768fb2aa3 ceb9fc3691ce8326

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 The hash value is then calculated as

H1,7 = 5be0cd19137e2179 + ceb9fc3691ce8326 = 2a9ac94fa54ca49f

H1,6 = 1f83d9abfb41bd6b + 25c96a7768fb2aa3 = 454d4423643ce80e
H1,5 = 9b05688c2b3e6c1f + 9bb4d39778c07f9e = 36ba3c23a3feebbd
H1,4 = 510e527fade682d1 + d08446aa79693ed7 = 2192992a274fc1a8
H1,3 = a54ff53a5f1d36f1 + 654ef9abec389ca9 = 0a9eeee64b55d39a
H1,2 = 3c6ef372fe94f82b + d67806db8b148677 = 12e6fa4e89a97ea2 44
H1,1 = bb67ae8584caa73b + 10d9c4c4295599f6 = cc417349ae204131
H1,0 = 6a09e667f3bcc908 + 73a54f399fa4b1b2 = ddaf35a193617aba

The resulting 512-bit message digest is

ddaf35a193617aba cc417349ae204131 12e6fa4e89a97ea2 0a9eeee64b55d39a

2192992a274fc1a8 36ba3c23a3feebbd 454d4423643ce80e 2a9ac94fa54ca49f

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

Mukesh Chinta, Asst Prof, CSE, VRSEC 45
Mukesh Chinta, Asst Prof, CSE, VRSEC 46
 HMAC
▪ In cryptography, a keyed-hash message authentication code (HMAC) is a
specific type of message authentication code (MAC) involving a
cryptographic hash function and a secret cryptographic key.

47
▪ Any cryptographic hash function, such as MD5 or SHA-1, may be used in the
calculation of an HMAC; the resulting MAC algorithm is termed HMAC-
MD5 or HMAC-SHA1 accordingly. The cryptographic strength of the HMAC
depends upon the cryptographic strength of the underlying hash function, the
size of its hash output, and on the size and quality of the key.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Objectives of HMAC
In recent years, there has been increased interest in developing a MAC derived from a cryptographic
hash function. The motivations for this interest are
1. Cryptographic hash functions such as MD5 and SHA-1 generally execute faster in software than
symmetric block ciphers such as DES.
2. Library code for cryptographic hash functions is widely available.

RFC 2104 lists the following design objectives for HMAC:

▪ To use, without modifications, available hash functions. In particular, hash functions that perform
well in software, and for which code is freely and widely available. 48

▪ To allow for easy replaceability of the embedded hash function in case faster or more secure hash
functions are found or required.
▪ To preserve the original performance of the hash function without incurring a significant
degradation.
▪ To use and handle keys in a simple way.
▪ To have a well understood cryptographic analysis of the strength of the authentication mechanism
based on reasonable assumptions about the embedded hash function.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

HMAC Algorithm
H = embedded hash function (e.g., MD5, SHA-1, RIPEMD-160)
IV = initial value input to hash function
M = message input to HMAC(including the padding specified in
the embedded hash function)
Yi = ith block of M, 0 ≤ i ≤ (L - 1)
L = number of blocks in M
b = number of bits in a block
n = length of hash code produced by embedded hash function
49
K = secret key recommended length is ≥ n; if key length is greater
than b; the key is input to the hash function to produce an n-bit
key
K+ = K padded with zeros on the left so that the result is b bits in
length
ipad = 00110110 (36 in hexadecimal) repeated b/8 times
opad = 01011100 (5C in hexadecimal) repeated b/8 times

HMAC(K,M) = H[(K+ ⊕opad)||H[(K+⊕ ipad)||M]]

 In words, HMAC can be described as:
1. Append zeros to the left end of K to create a b-bit string K+(e.g., if K is of length 160 bits and b =
512 then K will be appended with 44 zero bytes 0 x 00).
2. XOR (bitwise exclusive-OR) K+ with ipad to produce the b-bit block Si.
3. Append M to Si.
4. Apply H to the stream generated in step 3.
5. XOR K+ with opad to produce the b-bit block So
50
6. Append the hash result from step 4 to So
7. Apply H to the stream generated in step 6 and output the result.

▪ The XOR with ipad results in flipping one-half of the bits of K. Similarly, the XOR with opad
results in flipping one-half of the bits of K, but a different set of bits. In effect, by passing Si and
So, through the compression function of the hash algorithm, we have pseudorandomly generated
two keys from K.
▪ HMAC should execute in approximately the same time as the embedded hash function for long
messages.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 A more efficient implementation is possible, as
shown. Two quantities are precomputed. A more
efficient implementation is possible, as shown.
Two quantities are precomputed.

f(IV, (K + ⊕ ipad))
f(IV, (K + ⊕ opad))

where f(cv, block) is the compression function for

the hash function, which takes as arguments a
chaining variable of bits and a block of bits and
produces a chaining variable of bits.

This efficient implementation is especially

worthwhile if most of the messages for which a
MAC is computed are short.

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

51
 Data Authentication Algorithm (DAA)
➢ The Data Authentication Algorithm, based on DES, has been one of the most widely used MACs for a
number of years. The algorithm is both a FIPS publication (FIPS PUB 113) and an ANSI standard
(X9.17).
➢ The algorithm can be defined as using the cipher block chaining (CBC) mode of operation of DES
shown below with an initialization vector of zero

52

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 The data (e.g., message, record, file, or program) to be authenticated are grouped into contiguous
64-bit blocks: D1, D2,..., DN. If necessary, the final block is padded on the right with zeroes to form a
full 64-bit block. Using the DES encryption algorithm, E, and a secret key, K, a data authentication
code (DAC) is calculated as follows:

The DAC consists of either the entire block ON or the

leftmost M bits of the block, with 16 ≤ M ≤ 64

53

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 Cipher-based Message Authentication Code (CMAC)

▪ In cryptography, CMAC is a block cipher-based message authentication code

algorithm. It may be used to provide assurance of the authenticity and, hence, the
integrity of binary data. This mode of operation fixes security deficiencies of
CBC-MAC (CBC-MAC is secure only for fixed-length messages).
▪ It is specified in NIST Special Publication 800-38B for use with AES and triple
DES.
54
▪ when the message is an integer multiple n of the cipher block length b. For AES,
b=128, and for triple DES, b=64.
▪ The message is divided into blocks (M1, M2,.....,Mn). The algorithm makes use of a
K-bit encryption key and an -bit constant, K1.
▪ For AES, the key size is 128, 192, or 256 bits; for triple DES, the key size is 112 or
168 bits

Mukesh Chinta, Asst Prof, CSE, VRSEC 14CS3606 Cyber Security

 C1 = E(K, M1)
C2 = E(K, [M2 ⊕ C1])
C3 = E(K, [M3 ⊕ C2])
.
.
.
Cn = E(K, [Mn ⊕ Cn-1 ⊕ K1])
T = MSBTlen(Cn)
T = message authetication code, also referred to
as the tag
Tlen = bit length of T
MSBs(X) = the s leftmost bits of the bit string X

55