WO2008034998A1

WO2008034998A1 - Improvement of the resistance to cryptanalytic attacks of a hash function

Info

Publication number: WO2008034998A1
Application number: PCT/FR2007/051943
Authority: WO
Inventors: Olivier Billet; Matthew Robshaw
Original assignee: France Telecom
Priority date: 2006-09-18
Filing date: 2007-09-14
Publication date: 2008-03-27

Abstract

Improvement of the resistance to cryptanalytic attacks of a hash function. The invention relates to a method of transforming a first data message (M) of any length into a third data message (H) of determined length comprising: - a step of pseudo-randomly generating (A) a second data message (N) on the basis of the first message (M); - a step (B) of compressing said second message (N) into a third data message (H).

Description

Improved resistance to cryptanalytic attacks of a hash function.

The present invention relates to the field of computing and in particular to improving the resistance to cryptanalytical attacks of a condensation function (also known as "compression" or "hashing"). More particularly, the invention makes it possible to improve the security in the signature of the electronic messages.

Hash functions are currently widely used in cryptography. Indeed, they generate, from a message of arbitrary length input, a message of determined length output. They thus facilitate the creation of electronic signatures that guarantee the integrity and authenticity of the information. They serve, for example, to produce electronic certificates, and intervene in many authentication protocols.

To ensure a high level of security, the hash functions must be able to withstand different attacks. They must be able to withstand, for example, collisions. Collisions consist in obtaining, from different messages, the same result at the exit of the function. But for a hash function ensuring a good level of security, it is very difficult to find such messages in a reasonable time. However X. Wang and H. Yu demonstrated in their articles "How to Break MD5 and Other Hash Functions" in May 2005 and "Finding Collisions in the FuIl SHA-I" in August 2005, that by choosing messages with a structure particular, it is possible to build collisions in a reasonable time. This weakens the confidence that users place in these functions. Indeed, if a hash function does not survive collisions, there are doubts about its ability to guarantee other properties. These other properties are, for example, that of being one-way or that of being resistant to a second antecedent.

Szydlo and Yin then proposed in the document "Resistant Collision Usage of SHA-I via Message Pre-Processing", a pre-processing step. This step modifies the structure of the messages before they enter the hash function. The preprocessing step consists, in particular, in a simple duplication of all or part of the message. This operation could easily be bypassed by cryptanalysts, in order to create new collisions.

The present invention makes it possible to mitigate or at least reduce all or some of the aforementioned drawbacks in that during a method of transforming a first data message of any length into a third data message of determined length, a step pseudo-randomly generates a second data message from the first message, said second message being compressed into a third message. The stage of Pseudo-random generation is implemented in a hash device.

Thus, the pseudo-random generation step unpredictably modifies the structure of the first message. It will therefore be more difficult for an attacker to impose a particular structure on the second message. This improves the cryptanalytical attack resistance of the hash function used during the compression step.

According to preferred non-limiting embodiments, the method which is the subject of the invention has the additional characteristics taken separately or in combination, set out below:

The pseudo-random generation step makes it possible to generate a second data message of greater length than the first message.

Thus, obtaining a structure desired by the attacker for the second message is more difficult to obtain.

The pseudo-random generation step uses a stream cipher algorithm. This algorithm generates messages. These messages, for an attacker, are indistinguishable from random messages. It is therefore very difficult for this attacker to determine a first message so that the second message has the desired structure. Moreover, it is very difficult to go back to the first message starting from the second. Finally, the use of such an algorithm makes it possible to adapt the length of the messages to the hash function used. The pseudo-random generation step of the second data message is done from a string variable.

The use of the string variable thus makes it possible to improve the randomness of the second message generated.

According to a second subject of the invention, a device for transforming a first message comprises:

a device for pseudo-random generation of a second data message from the first message; a hash device of the second message for generating a third data message of determined length, the pseudo-random generation device being implemented in the hash device.

According to preferred non-limiting embodiments, the device that is the subject of the invention has the additional characteristics taken separately or in combination, set out below:

The pseudo-random generation device makes it possible to generate a second message of greater length than the first message.

The pseudo-random generation device uses a stream cipher algorithm.

The pseudo-random generation of the second message is done from a string variable. According to a third subject of the invention, a method of signing a first data message comprises:

a pseudo-random generation step of a second data message from the first data message; a step of compressing said second message into a third data message; a cryptographic step of said third message to generate a fourth message;

a step of assembling said fourth message with the first data message.

A fourth object of the invention relates to a device for signing a first data message for implementing the method according to the third subject of the invention.

According to a fifth subject of the invention, a computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor, comprises instructions for performing the steps of the method according to the first object of the invention.

The invention will be better understood and other features and advantages will appear on reading the description, given by way of example, this description with reference to the appended drawings showing:

In FIG. 1, a device for processing a data message according to a first embodiment of the invention; - In Fig.2, a device for processing a data message according to a second embodiment of the invention;

- In Fig.3, a device for processing a data message according to a third embodiment of the invention;

- In Fig.4, a method of processing a data message and a method of signing a data message according to the invention.

The invention is described below in a particular application for the signature of electronic messages. However, this invention also applies to any system using a hash function.

FIG. 1 shows a device 1 for transforming a first message M according to a first embodiment of the invention.

This transformation device 1 makes it possible, from a first message M of data, of any length, to generate a third message H of determined length h. The message M is here a digital data message, alternatively the data can be of any type.

The transformation device 1 comprises a pseudo-random generating device 5 of a second message N and a hashing device 4 for generating a third message H of a predetermined length. It will be noted that N can also be written W (M) where W is the function transforming the message M into a message N.

The generation device 5 is intended to form a pseudo-random data message N to from a message M of any length. This device constitutes a pre-treatment or "pre-whitening" for the hash device 4. Pre-whitening is an operation that makes the structure of a message unpredictable.

By structure, we must understand the set of properties that govern the value of the data bits between them.

The generating device 5 thus comprises forming means 2, calculation means 13 and concatenation means 14.

The forming means 2 are intended to form a sequence Ml,..., Mi,..., Mt of t data blocks from a message M. Each block is of a length of K bits, K being for example, of the order of 256 bits. This can be typically done by adding additional elements ΔM to the message M to form a completed message M + ΔM. The length of the completed message is then a multiple of that of a block Mi. Advantageously, the additional elements ΔM may comprise information relating to the original message M, such as the initial length of this message M. These training means 2 comprise and padding means 11 and padding means 12. The stuffing means 11 are intended to stuff the message M by the additional elements ΔM. This makes it possible to complete the length of the message so that it can be subdivided into blocks Mi of desired length. The subdivision means 12 are intended to subdivide the completed message M + ΔM to form the sequence Ml, ... Mi, ... Mt of t blocks of length K bits.

Computing means 13 define a pseudo-random sequence, a sequence N1,..., Ni,..., Nt of t data blocks of length b bits from the sequence Ml, ..., Mi, ..., Mt of the first message. These calculation means 13 are, for example, algorithms ensuring from a block Mi the generation of a block Ni. This generation is made so that it is very difficult for an attacker to distinguish the sequence Nl, ... Ni, ... Nt of a pseudo-random sequence. In addition, the means 13 are non-invertible, that is to say the knowledge of the sequence N1,..., Ni,..., Nt does not make it easy to find, by these means, a sequence Ml , ..., Mi, ..., Mt corresponding to him. These characteristics thus make it possible to prevent an attacker from imposing a chosen structure on the second message N of data entering the compression device 4. It will be noted that the algorithms also allow an expansion of the length of each block. The length b of a block Ni is thus greater than the length K of a block Mi. The length b is, for example, 512 bits. The calculation means 13 are, for example, flow cipher algorithms or "stream cipher" as the algorithm RC4. These algorithms make it possible to generate a pseudo-random sequence of blocks from a key K of length K bits. This key makes it possible to define the internal state of the means 13. The length of the key is smaller than the size of the internal state of these means. Alternatively, the length of the key is equivalent to the size of the internal state. The means 13 then constitute a simple pseudo-random generator of data blocks.

With the key CL, the calculation means 13 generate b data bits such that:

SC (K) = S1 S2 S3 S4 S5 ... Sj with SC corresponding to the sequence S1, .., Sj of bits obtained with the means 13 by the use of the key K of length K bits. The variable j corresponds to the number of clock strokes required to obtain a sequence SC of length b bits. The means 13 of calculation use, here, the sequence Ml, ..., Mi, ..., Mt as t keys of length K bits. Thus, it is possible to generate the sequence N1,..., Ni,..., Nt such that: SC (M1) = S1, S1, S1, S1, S1, j = N1 SC (M2 ) = S2,1 S2,2 S2,3 ... S2, j = N2

SC (Mt) = St, 1 St, 2 St, 3 ... St, j = Nt

Note that at each clock stroke, the number of bits generated by the means 13 is e. When e = 1, we have j = b. In a variant, at each clock stroke the number of bits generated by the means 13 is for example e = 8, e = 32 or e = 64, which corresponds respectively to j = b / 8, j = b / 32 or j = b / 64.

The use of the sequence Ml, ..., Mi, ..., Mt as t keys is not the only possibility. Floating algorithms often have a second entry called the initialization vector. This vector is a fixed number. In a variant, this vector varies. It corresponds, for example, to the sequence Ml, ..., Mi, ..., Mt of t blocks. Thus the key CL used in the calculation means 13 is a combination of the initialization vector and the sequence Ml,..., Mi,..., Mt of the t blocks.

The use of stream encryption algorithms makes it easy to vary the length of the blocks at the output of the calculation means 13. For this, just wait for as many clocks as necessary. Indeed, the length of the key CL is variable. This makes it possible to adapt the generating device 5 to the hash device 4 used.

Alternatively, it is possible to use block cipher or "block" algorithms These algorithms do not normally make it possible to easily vary the length of the blocks at the output of the calculation means 13. However, by using such algorithms in particular operating modes, such as the OFB or output feedback mode "or" counter "mode, it is possible to achieve the same result as a" stream cipher ".

The t * b bits generated by the calculation means 13 are then assembled by the concatenation means 14 to form the pseudo-random data message N.

The message N is then processed by the hash device 4. For this purpose a second padding device 15 stuffs the message N with additional elements ΔN in order to complete the message length so that it can be subdivided into blocks of the desired length. Subdivision means 16 are thus intended to subdivide the completed message N + ΔN. The means 16 then form the sequence N'1, ..., N'i, ..., N'c of c blocks of length d bits.

In some cases, c and t are equal as well as the lengths b and d. It is not then necessary to complete the length of the message for its processing by the compression means 17. This is the case for example when combining an algorithm RC4, generating a message N multiple of 512 bits, with a function SHA-I hash that uses 512-bit block sequences as input. However, for reasons of cost and simplicity, it is sometimes appropriate to use existing compression devices 4. In this case, the means 15 and 16 are maintained. The compression means 17 are here formed according to the Merkle-Damgard structure. This structure performs the compression in the form of a chain of operations successively performed by a compression function f. Alternatively, it is possible to perform the compression in the form of tree operations.

In the Merkle-Damgard structure, the compression function is repeated iteratively. Step i uses two elements, namely a block N'i of length d bits and a string variable Vi-I of length h fixed. The output of the compression function is the next value of the string variable, Vi of length h bits, such that Vi = f (Vi-I, N 'i). Thus the compression function transforms an input of h + d bits into an output of length h bits. In the last step, i = c and the last outgoing string variable is Vc, with Vc = f (... f (V0, N'l), N'2), ... N'c). Note that the initial string variable VO is dependent on the compression function f used.

Finally, determination means 18 make it possible to determine the third message H, also denoted by H (W (M)), as a function of the last output Vc. Thus, H = φ (Vc) where φ is any function that can simply be the identity function so that H = Vc.

Thus, the "pre-whitening" performed by the device 5 makes it possible to substitute the message M with a message N. In order for the message N to be generated pseudo-randomly, the "stream cipher" must be strong at the cryptographic level. The stream cipher must therefore respect different conditions. One of these conditions is that the sample of SC (CL) output must remain indistinguishable, for an attacker, from a sample derived from a real random source. Another condition is that an attacker must have no chance of determining, in a reasonable time, a pair of keys CL1 and CL2, such as SC (CL1) = SC (CL2). Another condition is that the means 13 must not be invertible. Thus, the knowledge of the sequence N1,..., Ni,..., Nt does not easily make it possible to find a sequence Ml,..., Mi,..., Corresponding Mt.

Thus, with a "stream cipher" respecting these conditions, the attacks on the compression functions f are countered. Indeed, the attacker can not easily manipulate the structure of the message N because the pre-treatment prevents it. Pre-whitening thus improves the resistance of the chopper device 4.

The pre-processing device 5 furthermore makes it possible to reinforce the security of the chopper device 4. Even if the hash function is fragile to certain attacks, the calculation means 13 prevent an attacker imposing a particular message structure at the input of the device 4. The transformation device 1 is then generally resistant to the pre-image , the second pre-image or collisions while the hash function may not be. Preprocessing makes it possible to make the hash function cryptographically safer.

Note that the embodiment presented here allows to use, without modifications, a hash device using an existing hash function. It leaves, indeed, the internal operations to the hash function unchanged. The implementation of the transformation, with the existing hash devices, is therefore very simple.

Finally, note that the most used compression functions are for example SHA-I or MD5.

Fig.2 shows a device 20 for transforming a first data message according to a second embodiment of the invention.

This embodiment differs from the previous one in that the transformation device 20 comprises a hashing device 24 in which calculation means 23 are implemented for the pseudo-random generation of a second message N.

Indeed, the hashing device 24 consists, here, of forming means 22, compression means 27, determining means 28.

Calculation means 23 are inserted between the forming means 22 and the compression means 27. These means constitute a pre-treatment or "pre-whitening" for the compression means 27. The pseudo-random generating device 21 is therefore reduced here to the calculation means 23.

A first message M of any length data is first stuffed by the means 25 and then subdivided into a sequence Ml, ..., Mi ..., Mc of c data blocks of length k. A second message N, represented by a sequence N1,... Ni,..., Nc of c blocks of data of length b, is generated pseudo-randomly by the calculation means 23. Note that b is generally greater than c.

The sequence is then used by the compression means 27 to output the channel variable Vc. The means of determination finally make it possible to determine the third message H. Fig.3 shows a device 30 for transforming a first data message according to a third embodiment of the invention. This device comprises a hashing device 34 in which calculation means 33 are implemented for the generation of a second message N block sequence N1, ..., Ni, ..., Nc. The pseudo-random generation device 31 is reduced here to the calculation means 33. In this embodiment, the means 33 receive as input the sequence N1, ..., Ni, ... Nc. This sequence comes from a first message M stuffed and subdivided by the means 35 and 36 constituting training means 32. The means 33 also receive at each iteration of the compression function a string variable.

The block Ni constituting the pseudo-random sequence N1,..., Ni,..., Nc then comes from an operation, associating as input the block Mi with the variable Vi-I.

The use of the string variable thus makes it possible to improve the randomness of the sequence N1,..., Ni,..., Nc generated.

It will be noted that the "stream cipher" also adapts the size of each block Ni to the hash function used in the compression means 37.

Fig.4 shows a method of signing a first message. This method uses the steps of a method of transforming said first message M to generate a message H of determined length.

The transformation method thus comprises a pseudo-random generation step A of a second data message N from the first message M. This step modifies in a non-predictable way for a attacking the message structure M. It will therefore be more difficult for an attacker to impose a particular structure on the second message N. This improves the resistance of the hash device. Alternatively, step A generates a second message N of data longer than the first message. This increases the complexity for an attacker to impose a particular structure on the second message. Note that the pseudo-random generation step uses a stream cipher algorithm. This algorithm makes it possible to generate pseudo-random data messages that are difficult to distinguish for an attacker. In addition, with such an algorithm an attacker can not find the first message M from the knowledge of the second message N.

In one embodiment, pseudo-random generation step A is implemented in a hash device.

The transformation method also comprises a step B of compressing the second message N into a third message H constituting the fingerprint of the message M. The signature method further comprises steps A and B, a cryptography step C to generate a fourth message S or signature. This step is performed, for example, using a private key. It guarantees the authenticity and integrity of the third message M.

The fourth message S is then assembled with the first message M to form the M + S signed message. The method of transforming a first data message and the method of signing a first data message are implemented by a computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor. This computer program thus comprises instructions for executing the steps of said methods. Alternatively, the different methods are implemented logically.

Claims

A method of transforming a first message (M) of data of any length into a third message (H) of data of a determined length comprising:

a step of pseudo-random generation (A) of a second message (N) of data from the first message (M), the pseudo-random generation step (A) being implemented in a hash device (24); 34);

a step of compressing (B) said second message (N) into a third message (H) of data.

2. Transformation method according to the preceding claim characterized in that the pseudo-random generation step (A) generates a second message (N) data longer than the first message (M).

3. Transformation method according to any one of the preceding claims, characterized in that the pseudo-random generation step (A) uses a stream cipher algorithm.

4. Transformation method according to any one of the preceding claims, characterized in that the pseudo-random generation step of the second message (N) data is from a string variable (Vi).

A device for transforming a first message comprising: a pseudo-random generation device (5; 21; 31) of a second data message (N) from the first message (M);

a hash device (24; 34) of the second message (N) intended to generate a third message

(H) data of determined length, the pseudo-random generating device (21; 31) being implemented in the hash device (24; 34).

6. Transformation device according to the preceding claim characterized in that the pseudo-random generating device (21; 31) generates a second message (N) longer than the first message (M).

7. Transformation device according to any one of claims 5 to 6 characterized in that the pseudo-random generation device (21; 31) uses a stream cipher algorithm.

8. Transformation device according to any one of claims 6 to 7 characterized in that the pseudo-random generation of the second message (N) is from a string variable (Vi).

A method of signing a first data message comprising: a pseudo-random generation step (A) of a second data message (N) from the first data message (M);

a step of compressing (B) said second message (N) into a third message (H) of data; a cryptography step (C) of said third message (H) for generating a fourth message (S); an assembly step (D) of said fourth message (S) with the first data message (M).

10. Device for signing a first message (M) data for the implementation of the method according to the preceding claim.

11. Computer program downloadable from a communication network and / or stored on a computer-readable medium and / or executable by a microprocessor, characterized in that it comprises instructions for the execution of the steps of the process of transformation of the computer. a message (M) according to any one of claims 1 to 4.