Problem - Kevin Tafuro

See Also
Recipes 5.5, 6.3, 6.7, 6.16
6.16 Using a Block Cipher to Build a Full-Strength
Hash Function
Problem
Given a block cipher, you want to produce a one-way hash function, where finding
collisions should always be as hard as inverting the block cipher.
Solution
Use MDC-2, which is a construction that turns a block cipher into a hash function
using two Matyas-Meyer-Oseas hashes and a bit of postprocessing.
Discussion
Hash functions do not provide security in and of themselves! If you
need to perform message integrity checking, use a MAC instead.
The MDC-2 message digest construction turns an arbitrary block cipher into a oneway
hash function. It’s different from Davies-Meyer and Matyas-Meyer-Oseas in that
the output of the hash function is twice the block length of the cipher. It is also protected
by patent until August 28, 2004.
However, MDC-2 does use two instances of Matyas-Meyer-Oseas as components in
its construction. Matyas-Meyer-Oseas hashes block by block and uses the internal
state as a key used to encrypt each block of input. The resulting ciphertext is XOR’d
with the block of input, and the output of that operation becomes the new internal
state. The output of the hash function is the final internal state (though if the block
size is not equal to the key size, it may need to be expanded, usually by repeating the
value). The initial value of the internal state can be any arbitrary constant. See
Figure 6-2 for a depiction of how one block of the message is treated.
An issue with Matyas-Meyer-Oseas is that the cipher block size can be smaller than
the key size, so you might need to expand the internal state somehow before using it
to encrypt. Simply duplicating part of the key is sufficient. In the code we provide
with this recipe, though, we’ll assume that you want to use AES with 128-bit keys.
Because the block size of AES is also 128 bits, there doesn’t need to be an expansion
operation.
294 | Chapter 6: Hashes and Message Authentication
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.