Problem - Kevin Tafuro

Noncorrelation
It should also be computationally infeasible to find out anything about the original
plaintext value; the input bits and output bits should not be correlated.
Weak collision resistance
If given a plaintext value and the corresponding hash value, it should be computationally
infeasible to find a second plaintext value that gives the same hash value.
Strong collision resistance
It should be computationally infeasible to find two arbitrary inputs that give the
same hash value.
Partial collision resistance
It should be computationally infeasible to find two arbitrary inputs that give two
hashes that differ only by a few bits. The difficulty of finding partial collisions of
size n should, in the worst case, be about as difficult as brute-forcing a symmetric
key of length n/2.
Unfortunately, there are cryptographic hash functions that have been found to be
broken with regard to one or more of the above properties. MD4 is one example that
is still in use today, despite its insecurity. MD5 is worrisome as well. No full break of
MD5 has been published, but there is a well-known problem with a very significant
component of MD5, resulting in very low trust in the security of MD5. Most cryptographers
recommend against using it in any new applications. In addition, because
MD5 was broken a long time ago, in 1995, it’s a strong possibility that a government
or some other entity has a full break that is not being shared.
For the time being, it’s not unreasonable to use MD5 in legacy applications and in
some applications where the ability to break MD5 buys little to nothing (don’t try to
be the judge of this yourself!), but do realize that you might need to replace MD5
entirely in the short term.
The strength of a good hash function differs depending on the circumstances of its
use. When given a known hash value, finding an input that produces that hash value
should have no attack much better than brute force. In that case, the effective
strength of the hash algorithm will usually be related to the length of the algorithm’s
output. That is, the strength of a strong hash algorithm against such an attack should
be roughly equivalent to the strength of an excellent block cipher with keys of that
length.
However, hash algorithms are much better at protecting against attacks against the
one-wayness of the function than they are at protecting against attacks on the strong
collision resistance. Basically, if the application in question requires the strong collision
resistance property, the algorithm will generally have its effective strength
halved in terms of number of bits. That is, SHA1, which has a 160-bit output, would
have the equivalent of 80 bits of security, when this property is required.
It can be quite difficult to determine whether an application that uses hash functions
really does need the strong collision resistance property. Basically, it is best to
Choosing a Cryptographic Hash Algorithm | 255
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.