Problem - Kevin Tafuro

One disadvantage of turning a block cipher into a hash function is speed. As we’ll
show in Recipe 6.3, dedicated cryptographic hash constructs tend to be faster than
those based on block ciphers.
In addition, all hash-from-cipher constructs assume that any cipher used will resist
related-key attacks, a type of attack that has not seen much mainstream study.
Because cryptographic hash functions aren’t that well studied either, it’s hard to say
which of these types of hash constructs is better.
It is clear that if you’re looking for message authentication, a good universal MAC
solution is better than anything based on a cryptographic hash function, because
such constructs tend to have incredibly good, provable security properties, and they
tend to be faster than traditional MACs. Unfortunately, they’re not often useful outside
the context of message authentication.
See Also
Recipe 6.3
6.3 Choosing a Cryptographic Hash Algorithm
Problem
You need to use a hash algorithm for some purpose (often as a parameter to a MAC),
and you want to understand the important concerns so you can determine which
algorithm best suits your needs.
Solution
Security requirements should be your utmost concern. SHA1 is a generally a good
compromise for those in need of efficiency. We recommend that you do not use the
popular favorite MD5, particularly in new applications.
Note that outside the context of a well-designed MAC, it is difficult to use a cryptographic
hash function securely, as we discuss in Recipes 6.5 through 6.8.
Discussion
A secure message digest function (or one-way hash function) should have the following
properties:
One-wayness
If given an arbitrary hash value, it should be computationally infeasible to find a
plaintext value that generated that hash value.
254 | Chapter 6: Hashes and Message Authentication
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.