WO2003026195A2

WO2003026195A2 - Method for the construction of hash functions based on sylvester matrices, block designs and error- correcting codes

Info

Publication number: WO2003026195A2
Application number: PCT/IE2002/000136
Authority: WO
Inventors: Aiden Bruen; David Wehlau; Mario Forcinito
Original assignee: Non-Elephant Encryption Systems (Barbados) Inc.; Coyle, Philip, A.
Priority date: 2001-09-20
Filing date: 2002-09-20
Publication date: 2003-03-27
Also published as: WO2003026195A3; AU2002337475A1

Abstract

An apparatus and method for constructing a hash function are provided such that an input string is mapped to an output string, the hash function being based on one of Sylvester matrices, balanced incomplete block designs, and error-correcting codes. The constructed hash function can be used by an apparatus for, among other uses, encrypting messages, determining if strings s and s' are equal, and for respectively storing and retrieving data into and from a memory .

Description

METHOD FOR THE CONSTRUCTION OF HASH FUNCTIONS BASED ON SYLVESTER MATRICES, BALANCED INCOMPLETE BLOCK DESIGNS AND

ERROR-CORRECTING CODES

RELATED APPLICATIONS

This application relates to our corresponding Application filed on the same date and entitled "A Key Agreement Protocol Based On Network Dynamics."

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to hash functions for mapping a set of input values S to a set of output T. More particularly, the present invention relates to hash functions for mapping a set of keys S to a set of target values T, which hash functions can be used to detect if two elements s, s' e S are in fact the same element and to respectively store and retrieve data into an from a memory.

2. Discussion of the Related Art

Hash functions are transformations that map from larger domains to smaller ranges. In many applications, such as digital signatures, it is necessary to have an irreversible function which takes an input string and returns a bit string of fixed length. Such one-way functions are referred to as one-way hash functions.

Hashing also may be viewed as a way to assign an abbreviation to a name. In this case the property of giving different results for different inputs is a desirable one. In practice, this property is required to be true "most of the time." That is, there should be a very low probability of getting the same result whenever the inputs are different. Hash functions having this property are usually referred to as "collision free" [10].

Hash functions commonly used in encryption systems include message digest (MD5), secure hashing algorithm (SHA) and secure hashing standard (SHS) and are based on subjecting the input(s) to several rounds of certain modular arithmetic operations and taking appropriate sub-strings from the results. Other techniques involve the use of substitution boxes (S-boxes) or even the use of encryption algorithms, such as data encryption standard (DES) and advanced encryption standard (AES) since encryption algorithms can be considered as particular cases of hash functions.

Yet another and more general approach is to choose (randomly or not) one or more hash functions from a large set of such functions such that the resulting hash is some combination of the results of the application of these hash functions to the same input.

SUMMARY OF THE INVENTION

The present invention provides a hash function H such that for two strings s and s' the condition s ≠ s' can be detected by applying this hash function H to each string and

checking that H(s) ≠ H(5^f). Conversely, by using the present invention, evidence for the equality of s and s' can be obtained by verifying that H(s) = H^¹) for many different hash functions H.

Consider the case where S consists of a subset of the vector space of dimension n over the finite field having only two elements, 0 and 1. That is to say, assume that S is a set of strings s of binary bits, each string having length n. Similarly, assume that T is a subset of the vector space of dimension m over the same finite field. That is to say, assume that T is a set of strings of binary bits, each string having length m.

Suppose further that it is desired to map S to T using a hash function H. The values of a hash function H may be written as a combination, such as a concatenation, of functions H(s) = (h/(s), h₂(-r), ... , _m sy) where each function h,(_f) e {0,1}. The function H is completely determined by the projected functions h;, h₂, ... , _m. Therefore it suffices to consider hash functions which take their values in the finite field, {0,1 }. In summary, hash functions mapping a set of binary ^-vectors to the set {0,1} are constructed by the present invention.

The present invention provides a method and apparatus for constructing a hash function H that maps strings s of S to strings H(s) of T, wherein

H(s) = (hι(s), h₂(s), ... , _m(s)) such that each h,(s) € { 0, 1 } , all h,(s) being based on one of Sylvester matrices, balanced incomplete block designs, and error-correcting codes. BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates construction of a hash function according to an embodiment of the present invention employing block designs.

FIG. 2 illustrates construction of a hash function according to an embodiment of the present invention employing algebraic codes.

FIG. 3 illustrates construction of a hash function according to the present invention for an input key corresponding to data to be stored/retrieved in/from a memory by a computer apparatus. FIG. 4 illustrates a computer apparatus at cryptographic station A and B that employs a hash function constructed according to the present invention to obtain an unconditionally secure cryptographic key from the keys received at each station.

FIG. 5 illustrates determining equality of tow input strings by a computer apparatus at station A and B using a hash function H constructed according to the present invention.

FIG. 6 illustrates a computer apparatus obtaining a cryptographic digital signature from an algorithm that uses a hash function, the has function being constructed according to the present invention.

FIG. 7 illustrates a computer apparatus constructing a hash function according to the present invention for a given input string and then using this hash function to perform cryptographic message authentication.

DETAILED DESCRIPTION OF THE INVENTION

The present invention provides a method for obtaining a hash function H = ( ι(s), h₂(s),...,h_m(s)) over a given finite field using Sylvester matrices, block designs or algebraic codes.

Hash Functions Using Block Designs

Referring now to FIG. 1, a suitable hash function H(s) = (h (s), h₂(s), ... , h„._t(s)) can be obtained in the following way. Let s = {s_\, s₂, ... , s_n} 10 be a binary vector of length n. In one preferred embodiment, a set of n - 1 functions {h;(s), h₂(s), ... ,h„._t($)}, where t > 0, is obtained as follows. (1) Choose a family F of n-t linearly independent (with respect to

symmetric difference) subsets of an n-set Ω = {1,2,3 ή).

(2) Write F = { F_/, F₂, ..., F_M-,}, e.g., as the first n-t rows of an n x n matrix 20.

(3) Then define h;, h₂, ... h„._t by h s) = (∑_w j_{n F}J s_w)(mod 2), wherein

1 ≤j < n-t. These functions are described in [1] and [2]. Of course any such family F may suffice.

(4) Set H(s) = (h;(5), ₂(s), ... , „._t(s)).

However, in a preferred embodiment, when H is employed to encrypt S in order to maximize the difficulty of eavesdropping, F is constructed so that it has regularity properties. That is, it is required that the subset in F be "well spread out." Ideally the family F has the property that any two elements in Ω lie in a constant number of subsets in F. Further, it is desirable also that each subset in F has the same cardinality and that two different subsets in F intersect in a constant number of elements. Indeed these are the criteria that motivated the design of experiments in statistics [3], [4] leading to the combinatorial study of block-designs (see [5] and [6])

In cryptography a condition known as the Avalanche Criterion (AC) is used in the analysis of 5-boxes or substitution boxes (see for example [7], [8]), in which each 5-box takes a 6-bit input and produces a 4-bit output such that bits of a ciphertext depend on bits of a plaintext and bits of a key used to encrypt the plaintext to produce the ciphertext. The present invention adapts this criterion to hash functions such that, given a set of hash functions with values in {0,1}, if one bit of the input string is changed then the Avalanche Criterion requires that about half of the hash functions should change their output values.

In a preferred embodiment of the present invention, block designs are employed to construct a family of hash functions that satisfies all of these desirable criteria. A particular kind of block design arises from Sylvester matrices, the so-called Hadamard designs. Let H denote a 4 / x 4 t Hadamard matrix. This means that every entry in H is a 1 or -1 and that -HH* = 4t J_4t. Assume that such a matrix exists. There is a long standing open conjecture that at least one 4 t x 4 t Hadamard matrix exists for every t. This conjecture has been verified for all t ≤ 117. Furthermore, for infinitely many larger values oft, it is known that a 41 x 4 t Hadamard matrices does exist.

Suppose that H has been normalized so that its first row and first column consist

entirely of l's. A new a 4 t-1 x 4 t-1 matrix H is constructed, all of whose entries are either 0 or 1, as follows. The first row and first column (consisting of all l's) are deleted from H and then every -1 in the remaining matrix is changed to 0. The resulting matrix is

H . This matrix is the incidence matrix 20 of a block design with v = 4 t, k = 2t-l and λ = t - 1. This design is called a Hadamard 2-design.

For each row, r, of H define a linear hash function h_τ which maps a 4 t-1 -vector into its dot product with the row r. These 4 t-1 different hash functions satisfy the Avalanche Criterion as well as the other desirable conditions listed above.

If t is odd then these 4 t-1 linear hash functions are linearly independent. This fails if t is even. However, in this case, a large subset to the 4t-l hash functions are linearly independent. Suppose that n ≠ 3 (mod 4). Then a Hadamard design of size n cannot be constructed. In this case, a preferred embodiment of the present invention requires the use of the least integer n' > n where n' ≡ 3 (mod 4) and the extension of input strings to length n' by padding on the right with (at most 3) zeroes. This results in n' hash functions which are linearly dependent.

Hash Functions Using Algebraic Codes

Traditionally in cryptography binary codes are used as follows (see [9]). A string x is embedded in a code-word x belonging to some code C where x is obtained from x by adjoining to x parity bits corresponding to C. Traditional approaches, on the assumption of few errors, attempt to decode x from x. Here a new approach is provided by the present invention.

Recall that the hash function H is constructed to help decide whether two elements s and s' of S are equal. Consider the special situation where it is known (or known with high probability) that the Hamming distance between 5 and s' is less than some small integer d. In other words it is known that the number of bits where s and s' . differ is less than d.

Referring now to FIG. 2, consider an r x n matrix K 30 which is the parity check matrix of a code of minimum distance at least d. This means that the subspace of vectors perpendicular to every row of K 30 contains only one vector of Hamming weight less than or equal to d, namely, the zero vector. For each row r of K 30 define a function _r by taking _r(s) to be the dot product of row r and vector s. Thus, given vectors s and s' such that h_r(s) = ^s') for all rows r of K 30 then s + s' is an element of the code of minimum distance d. Therefore either s = s' or else the Hamming distance between s and s' is at least d (s differs from ' by at least d bits) and the desired hash function is H(s) =

Example

Suppose that n is some integer with 64 < n ≤ 128 and that A and B are two binary vectors of length n. An 8 x 128 parity check matrix K 30 is constructed. First, a 7 x 128 matrix

Kis constructed. Consider the 128 columns ofK . All 128 columns of K should be

distinct (different). Take the first 8 columns of K to be:

The remaining 120 distinct columns of K may be arranged in any order, say in lexicographic order.

Next, K 30 is obtained from K by adding a row consisting entirely of l's to the

top of K . Then K 30 is the parity check matrix for a code of minimum distance 4. There are 8 hash functions h;, h₂, ..., h§ obtained by defining h,- to be the dot product 40 with row i of K 30. Now if n < 128, A and B are extended to new binary strings A ' and B' of length 128 by adding O's to the right of A and B. (Equivalently, the last 128-« columns may be truncated from K 30.) Now if WA") = HB*) for all i = 1,2,...,8 then either A' = B' or else the Hamming distance from A ' to B' is at least 4. Thus, clearly, either A = B or the Hamming distance from A to B is at least 4. The desired has function is H(_4) = j(A), ... MA).

Security

Finally, consider the extra possibility that it is desired to conceal the values of A and B from some eavesdropper, Eve, who has learned the values h;(.4),

In this case the first 8 bits may be deleted from A and B leaving

binary strings A and B of length «-8. Although 8 bits have been lost from A and B this is compensated for by the fact that Eve's knowledge of the values h,(4) and h,(-9) provides

her with no information about A and B . Apparatus

In a preferred embodiment, as illustrated in FIG. 3, a computer apparatus 60, preferably comprising at least one processor and at least one memory, is able to employ a hash function H(JK) 70 constructed according to the present invention in order to obtain a memory location corresponding to a received input key K associated with a data item 50 and then the same or another computer apparatus 80, preferably comprising at least one processor and at least one memory, is able to retrieve and store, beginning at location H(JT), the received data item associated with the received input key K.

In FIGs. 4-7 the computer apparatus similarly comprises at least one memory and/or at least one processor.

Similarly, FIG. 4 illustrates a computer apparatus 100 at cryptographic stations A and B that is able to employ the hash function constructed according to the present invention 100, to obtain and output 110 of an unconditionally secure cryptographic key from the respective received key K_A, K_B wherein K_A=K_B 90. And, as shown in FIG. 5, determination of the equality of two input strings KA and K_B 120 can be accomplished by a computer apparatus 130 employed by station A and B that is able to construct a hash function H and obtain H(K_A) and H(Kβ), with station A transmitting H(K_A) to station B 140 such that station B is able to verify that H(K_A)=H(K_B) and thereby conclude that K_A= K_B 150.

FIG. 6 illustrates a computer apparatus 170 that is able to obtain a cryptographic digital signature for a received input string 160 and then output the obtained cryptographic digital signature 180.

FIG. 7 illustrates a computer apparatus 200 that is able to receive an input string 190 and from this received string is then able to construct a hash function according to the present invention and perform cryptographic message authentication using this hash function, finally outputting the result of the authentication 210.

* * *

It will be understand by those skilled in the art that the above-described embodiments are but examples from which it is possible to deviate without departing from the scope of the invention as defined by the appended claims.

References and Bibliography

The following references as well as any reference mentioned elsewhere in this specification are hereby incorporated by reference as in fully set forth herein.

[1] Charles Bennett, Francois Bessette, Gilles Brassard, Louis Salvail, and John Smolin, Experimental quantum cryptography, EUROPCRYPT '90 (Arhus, Denmark), 1990, pp. 253-265.

[2] Samuel J. Lomonaco, A quick glance at quantum cryptography, Cryptologia 23 (1999), no. 1, 1-41.

[3] R. A. Fisher and F. Yates. Statistical Tables for Biological, Agricultural and Medical Research. Oliver-and-Boyd Ltd., third edition, 1948.

[4] D. Rhaghabarao. Constructions and Combinatorial Problems in the Design of Experiments. John Wiley & Sons, 1971.

[5] H. Lenz Thomas Beth, D. Jungnickel. Design Theory. Cambridge University Press,

1986.

[6] P.J. Cameron and G. E. van Lint. Designs, Graphs, Codes and their Lenghts.

Cambridge University Press, 1991. London Math Soc. Student Text vol 22.

[7] Richard A. Mollin. An Introduction to Cryptography. Chapman & Hall/CRC Press, 2000.

[8] RK Nichols, editor. ICSA Guide to Cryptography. Mc Craw Hill, 1999.

[9] Charles H. Bennett, Gilles Brassard, and Jean-Marc Robert, Privacy Amplification by Public Discussion, Siam J. of Computing, 17, no.2 (1988), 210-229.

Claims

We claim:

1. A method of constructing a hash function H(x), for mapping an input string x_= (x;, x₂, ..., x„) of length ri>0 to an output string of length n-t, \<t<n, of the set of strings H(x) = {(h;(x), h₂(x), ..., h„.,(x))}, said input and output string being defined over a given finite field F and H(x) being defined as a concatenation of said functions h,(x), said method comprising the steps of: a) providing a binary incidence matrix A having n columns and n rows, for a balanced incomplete block design on n points; b) selecting a set of n-t rows, R;, R₂, ... , R_n-t , of the rows of A such that said selected n-t rows are linearly independent over F, wherein no F-linear independent combination of said selected set of n-t rows is a zero row save for an all-zero linear combination of said selected set of rows; c) for each said row R,-, obtaining a subset F, of a n-set Ω = { 1 , 2, ... n} , said subset being positions in which the row R; has a 1, wherein 1 <i ≤ n-t. d) for said input string, setting_h,(x) = (Σ_Win_FιX ), wherein 1 < i ≤ n-t and e) defining said hash function as an output string created by the concatenation of hr(x) for l≤ i ≤ n-t , H(x) = (h₇(x), h₂(x), ..., h_n-/(x))

2. The method of claim 1 , further comprising the steps of: a.l) providing the input string x as a concatenation of 1^st through s^Λ component strings yi, Y2, • • -Ys of length v/, v_2j ... v_s; and a.2) conducting steps a) through e) on each of said 1^st through s* component string y;, y_>, ...y_s, such that H(x) is a concatenation of the hash functions defined by step e) for each of said 1^st through s^Λ component strings, namely, H; (y ), H₂ (y₂), ..., U_s

(Js)-

3. The method of claim 1 , wherein F = Z , the binary field consisting of the elements 0,1.

4. The method of claim 1 , wherein F = Z and A is an incidence matrix of Hadamard design on n points with n D 3 (mod 4), obtained from a Sylvester matrix of size ( + l)x(« + l).

5. A method of constructing a hash function H(x) for mapping an input string x = (x;, x₂, ..., x_v ) of length n>0 to an output string H(x) = {(h;(x), h₂(x), ..., h_n._t(x))} of length n- 1, \<t<n, said method comprising the steps of: a) providing a matrix M having size (n- t)x n, rows Ri x columns, and rank n- 1 over a given finite field F whereby the Hamming distance between any two distinct vectors obtained from a distinct linear combination of the rows of M, is at least d, where d is some pre-assigned positive integer; b) for each said row Rj of M, setting h,- (x) = x*R,, 1 ≤ i ≤ n-t where ^• denotes the dot product operation; and c) defining said hash function H(x) as the function H(x) = {(h_/(x), h₂(x), ..., h„.,(x))} for l<fDn.

6. The method of claim 5, wherein F - Zz , the binary field consisting of the elements 0,1.

7. The method of claim 5, wherein M is a generator matrix for a linear code having a minimum distance d over the field F.

8. The method of claim 5, further comprising the steps of: a.1 ) providing the input string (x) as a concatenation of 1 ^st through s* component string yj, Y_2, ...yj_of length vj_, v_2; ... v₅; and a.2) conducting steps a) through c) on each of said 1^st through s* component strings y;_,

Y2, • ■ -y_s, such that H(x) is a concatenation of the hash functions defined by step c) for each of said 1^st through s^ft component strings, namely, H; (yj), H₂ (yj)... H_s

&).

9. A method of verifying with certainty that a first and second cryptographic string K_A and KB over a finite field F in first and second cryptographic station A and B, respectively, are equal, wherein the Hamming distance between said first and second string KA and KB is less than a pre-assigned positive integer d, said method comprising the steps of: a) choosing a linear code C over F, said linear code C having a minimum distance d; b) publicly selecting a generator matrix M for said linear code C, said matrix M having a size (n- t)^χ n, rows x columns; c) in said first cryptographic station A, transmitting H(KA) to said second station B, wherein H is constructed by the method of claim 1, wherein M is provided as the incidence matrix of step a); d) in said second cryptographic station B, verifying that H(KA) = H(K_B), wherein H(KB₎ is constructed by the method of claim 1, wherein M is provided as the incidence matrix of step a); and e) when H(KA) = H(KB), concluding with certainty that K_A = KB.

10. A method of generating an unconditionally secure cryptographic key between a first and second cryptographic station A and B given a binary key KA in said first station A and a binary key KB in said second station B having a common length n and such that A = KB = K, wherein at most t Shannon bits of the key K are known to an eavesdropper Eve, said method comprising the steps of: a) in said first and second station A and B for said given binary key K = KA = KB, constructing a hash function H by the method of claim 1 ; and b) in said first station and second station A and B, respectively, calculating an unconditionally secure cryptographic key L

11. A method of performing a cryptographic digital signature algorithm that utilises a hash function, wherein said hash function is constructed according to the method of claim 1.

1 . A method of performing a cryptographic digital signature algorithm that utilises a hash function, wherein said hash function is constructed according to the method of claim

5.

13. A method of performing a cryptographic message authentication algorithm (MAC) that utilises a hash function, wherein said hash function is constructed according to the method of claim 1.

14. A method of performing a cryptographic message authentication algorithm (MAC) that utilises a hash function, wherein said hash function is constructed according to the method of claim 5.

15. A memory look-up method for retrieving and storing a data item in a location of a memory which is associated with at least one particular value of an input string x_= (x;, x₂, ..., x„) of length ri>0, said method comprising the steps of: a) receiving said input string x; b) constructing a hash function H according to the method of claim 1 to map said received input string x to an output string H(x), wherein said output string H(x) indicates a location in said memory at which said data item can be retrieved and stored; and c) employing said output string H(x) to respectively retrieve and store said data item from and into said location of said memory.

16. A memory look-up method for retrieving and storing a data item in a location of a memory which is associated with at least one particular value of an input string x_= (x/, X₂, ... , x_«) of length «>0, said method comprising the steps of: a) receiving said input string x; b) constructing a hash function H according to the method of claim 5 to map said received input string x to an output string H(x), wherein said output string H(x) indicates a location in said memory at which said data item can be retrieved and stored; and c) employing said output string H(x) to respectively retrieve and store said data item from and into said memory.

17. A computer apparatus comprising a computer and a memory able to perform the algorithm of claim 1 to construct a beginning memory location as the output value H(iT) from an input string x equal to a key K for at least one of storing data associated with said key K starting at said beginning memory location H(-ST) and retrieving data from said beginning memory location H(K).

18. A computer apparatus comprising a memory and a processor able to perform the algorithm of claim 5 to construct a beginning memory location as the output value H(JK) from an input string x equal to a key K for at least one of storing data associated with said key K starting at said beginning memory location H( K) and retrieving data from said beginning memory location H(JE).

19. A first and second computer apparatus comprising a processor at a first and second cryptographic station A and B, wherein each of said first and second computer apparatus is able to perform the algorithm of claim 10 to generate an unconditionally secure cryptographic key from a received input string K, said input string K having at most t Shannon bits of K known to an eavesdropper Eve.

20. A computer apparatus comprising a processor able to perform the algorithm of claim 1 for each of a first and second input string, K_A and KB, in order to obtain first and second hash functions H(K_A) and H(K_B) and determine that KA=K_B whenever H(KA) = H(KB).

21. A computer apparatus comprising a processor able to perform the algorithm of claim 5 for each of a first and second input string, KA and KB, in order to obtain first and second hash functions H(KA) and H(K_B) and determine that KA⁼K_B whenever H(KA) = H(K_B).

22. A computer apparatus comprising a processor able to perform the algorithm of claim 1 for constructing a hash function as input to performing a cryptographic digital signature algorithm that utilizes said hash function.

23. A computer apparatus comprising a processor able to perform the algorithm of claim 5 for constructing a hash function as input to performing a cryptographic digital signature algorithm that utilizes said hash function.

24. A computer apparatus comprising a processor able to perform the algorithm of claim 1 for constructing a hash function as input to performing a cryptographic message authentication algorithm (MAC) that utilizes said hash function.

25. A computer apparatus comprising a processor able to perform the algorithm of claim 5 for constructing a hash function as input to performing a cryptographic message authentication algorithm (MAC) that utilizes said hash function.