Problem - Kevin Tafuro

6.15 Constructing a Hash Function from a Block
Cipher
Problem
You’re in an environment in which you’d like to use a hash function, but you would
prefer to use one based on a block cipher. This might be because you have only a
block cipher available, or because you would like to minimize security assumptions
in your system.
Solution
There are several good algorithms for doing this. We present one, Davies-Meyer,
where the digest size is the same as the block length of the underlying cipher. With
64-bit block ciphers, Davies-Meyer does not offer sufficient security unless you add a
nonce, in which case it is barely sufficient. Even with AES-128, without a nonce,
Davies-Meyer is somewhat liberal when you consider birthday attacks.
Unfortunately, there is only one well-known scheme worth using for converting a
block cipher into a hash function that outputs twice the block length (MDC-2), and
it is patented at the time of this writing. However, those patent issues will go away
by August 28, 2004. MDC-2 is covered in Recipe 6.16.
Note that such constructs assume that block ciphers resist related-key attacks. See
Recipe 6.3 for a general comparison of such constructs compared to dedicated constructs
like SHA1.
Discussion
Hash functions do not provide security in and of themselves! If you
need to perform message integrity checking, use a MAC instead.
The Davies-Meyer hash function uses the message to hash as key material for the
block cipher. The input is padded, strengthened, and broken into blocks based on
the key length, each block used as a key to encrypt a single value. Essentially, the
message is broken into a series of keys.
With Davies-Meyer, the first value encrypted is an initialization vector (IV) that is
usually agreed upon in advance. You may treat it as a nonce instead, however, which
we strongly recommend. (The nonce is then as big as the block size of the cipher.)
The result of encryption is XOR’d with the IV, then used as a new IV. This is
repeated until all keys are exhausted, resulting in the hash output. See Figure 6-1 for
a visual description of one pass of Davies-Meyer.
Constructing a Hash Function from a Block Cipher | 291
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.