[Page 374 (continued)]12.6. Key Terms, Review Questions, and Problems Key Terms big endian CMAC compression function HMAC little endian MD4 MD5 SHA-1 SHA-256 SHA-384 SHA-512 Whirlpool
[Page 375]Review Questions | 12.1 | What is the difference between little-endian and big-endian format? | | 12.2 | What basic arithmetical and logical functions are used in SHA? | | 12.3 | What basic arithmetical and logical functions are used in Whirlpool? | | 12.4 | Why has there been an interest in developing a message authentication code derived from a cryptographic hash function as opposed to one derived from a symmetric cipher? | | 12.5 | What changes in HMAC are required in order to replace one underlying hash function with another? |
Problems | 12.1 | In Figure 12.4, it is assumed that an array of 80 64-bit words is available to store the values of Wt so that they can be precomputed at the beginning of the processing of a block. Now assume that space is at a premium. As an alternative, consider the use of a 16-word circular buffer that is initially loaded with W0 through W15 Design an algorithm that, for each step t, computes the required input value Wt | | 12.2 | For SHA-512, show the equations for the values of W16,W17, W18, W19 | | 12.3 | Suppose a1 a2 a3 a4 are the 4 bytes in a 32-bit word. Each ai can be viewed as an integer in the range 0 to 255, represented in binary. In a big-endian architecture, this word represents the integer a1224 + a2216 + a328 + a4 In a little-endian architecture, this word represents the integer a4224 + a3216 + a228 + a1 Some hash functions, such as MD5, assume a little-endian architecture. It is important that the message digest be independent of the underlying architecture. Therefore, to perform the modulo 2 addition operation of MD5 or RIPEMD-160 on a big-endian architecture, an adjustment must be made. Suppose X = x1 x2 x3 x4 and Y = y1 y2 y3 y4. Show how the MD5 addition operation (X + Y) would be carried out on a big-endian machine. SHA assumes a big-endian architecture. Show how the operation (X + Y) for SHA would be carried out on a little-endian machine.
| | 12.4 | This problem introduces a hash function similar in spirit to SHA that operates on letters instead of binary data. It is called the toy tetragraph hash (tth).[5] Given a message consisting of a sequence of letters, tth produces a hash value consisting of four letters. First, tth divides the message into blocks of 16 letters, ignoring spaces, punctuation, and capitalization. If the message length is not divisible by 16, it is padded out with nulls. A four-number running total is maintained that starts out with the value (0, 0, 0, 0); this is input to the compression function for processing the first block. The compression function consists of two rounds. Round 1: Get the next block of text and arrange it as a row-wise 4 x 4 block of text and convert it to numbers (A = 0, B = 1, etc.). For example, for the block ABCDEFGHIJKLMNOP, we have: [5] I thank William K. Mason, of the magazine staff of The Cryptogram, for providing this example.
[Page 376]Then, add each column mod 26 and add the result to the running total, mod 26. In this example, the running total is (24, 2, 6, 10). Round 2: Using the matrix from round 1, rotate the first row left by 1, second row left by 2, third row left by 3, and reverse the order of the fourth row. In our example:
Now, add each column mod 26 and add the result to the running total. The new running total is (5, 7, 9, 11). This running total is now the input into the first round of the compression function for the next block of text. After the final block is processed, convert the final running total to letters. For example, if the message is ABCDEFGHIJKLMNOP, then the hash is FHJL. Draw figures comparable to Figures 12.1 and 12.2 to depict the overall tth logic and the compression function logic. Calculate the hash function for the 48-letter message "I leave twenty million dollars to my friendly cousin Bill." To demonstrate the weakness of tth, find a 48-letter block that produces the same hash as that just derived. Hint: Use lots of A's.
| | 12.5 | Develop a table similar to Table 4.8 for GF(28) with m(x) = x8 + x4 + x3 + x2 + 1. | | 12.6 | Show the E and E-1 mini-boxes in Table 12.3 in the traditional S-box square matrix format, such as that of Table 5.4. | | 12.7 | Verify that Figure 12.9 is a valid implementation of the S-box shown in Table 12.3a. Do this by showing the calculations involved for three input values: 00, 55, 1E. | | 12.8 | Provide a Boolean expression that defines the S-box functionality of Figure 12.9. | | 12.9 | Whirlpool makes use of the construction Hi = E(Hi-1,Mi)  i-1 i-1 Another construction that was shown by Preneel to be secure is Hi = E(Hi-1,Mi) Hi-1,Mi)lines. Consider the encryption We could write the final round key for this block as K10 = E(RC,Hi-1). Now show that the two hash constructions are essentially equivalent because of the way that the key schedule is defined. | | 12.10 | At the beginning of Section 12.4, it was noted that given the CBC MAC of a one-block message X, say T = MAC(K,X),the adversary immediately knows the CBC MAC for the two-block message X|(X T. Justify this statement. | | 12.11 | In this problem, we demonstrate that for CMAC, a variant that XORs the second key after applying the final encryption doesn't work. Let us consider this for the case of the message being an integer multiple of the block size. Then the variant can be expressed as VMAC(K,M) = CBC(K,M) 0 = 0n, where n is the cipher block size; the message 1 = 1n and the message 1||0. As a result of these three queries the adversary gets T0 = CBC(K,0) T1 = CBC(K,1) T2 = CBC(K,[CBC(K,1)]) 0||(T0 | 12.12 | In the discussion of subkey generation in CMAC, it states that the block cipher is applied to the block that consists entirely of 0 bits. The first subkey is derived from the resulting string by a left shift of one bit, and, conditionally, by XORing a constant that depends on the block size. The second subkey is derived in the same manner from the first subkey. What constants are needed for block sizes of 64 and 128 bits? Explain how the left shift and XOR accomplishes the desired result.
|
|
