bachelor

3.2 Attacking the MAC 27
3.2.1 Time-memory trade-offs
Time-memory trade-offs (TMTOs) are a class of precomputation attacks that
can be applyed to all one-way functions, that is functions taking any input and
producing an output that is computationally hard to source back to its preimage.
For a one-way function H and the result of the function c, the preimage is the
p that satisfies H(p) = c for some c. One-way functions are not designed to be
reversible, and as such hash functions and MACs pose as good candidates for
this kind of attack.
This thesis will decribe two time-memory trade-offs, namely Hellman tables as
described in the 1980 paper “A Cryptanalytic Time-Memory Trade-Off”[4] by
Hellman, and the 2003 paper “Making A Faster Cryptanalytic Time-Memory
Trade-Off”[9] by Oechslin.
3.2.1.1 Hellman tables
In a 1980 paper by Martin Hellman[4], a new “time-memory trade-off” is proposed.
The way it works is that it implements a reduction function R that
maps hash values back into the plaintext space. This facilitates the generation
of chains with alternating preimages and hash values. To further refine the
method, the one-way function is combined with the reduction function into a
new function f in order to get a mapping from the space of preimages to itself.
For some one-way function H, f can be described as f(p) = R(H(p)). f is also
known as the step function of the table.
The trick is then to only save the first and last values in the chain, discarding
all the intermediate steps. The table consists of some amount of chains m, all
starting with some random preimage and ending with a value equivalent derived
by performing the plaintext-to-plaintext function f over and over, always feeding
it with the output from the last iteration, see Figure 3.2.
d2654f → f 732efc → f 143679 → f 84e5dc → f f
} {{
. . . → 0006f3
}
d2654f→0006f3
Figure 3.2: A Hellman chain and how it is stored.
elements are in storage.
Only the first and last
For practicality reasons attacks employ more than just one table; having one table
cover a large keyspace will result in a very large file, which is time-consuming