14 Feb 1990
Hashing and MACs
hashing and macs
<- Internet Key Exchange <- Phase 3: Client Messages <- TLS Connection parameters <- TLS Session parameters <- Transport layer protocol
- Should be efficient and resistant to various forms of attacks.
- Can't recover plaintext from hash.
- Can't create collision given a plaintext.
- Can't create collision at all.
- Pseudo-random.
- A Message Authentication Code or a MAC is a keyed-hash function.
- M' = M || E[K, H(M)] (digital signature, only authenticity)
- M' = E[K, M] || H(M) (Works, but not standard)
- M' = E[K, M || H(M)] (Cryptographically better since this no hash to dict)
CCM
HMAC
- ipad = 0x36 repeated b/8 times.
- opad = 0x5c repeated b/8 times.
- K' = Key padded with zeros on the left.
- Step 1: H1 = H[(K' ^ ipad) || M]
- Step 2: H2 = H[K' ^ opad || H1]
Digital Signatures
<- ESP header mechanism <- Internet Key Exchange <- Auth modes <- Transport layer protocol
- S is a hash only secret key.
- LOT OF RSA encryption
- M || E[K, H(M||S)] (message in cleartext, repudiation possible)
- E[K, M || H(M||S)] (repudiation possible)
- M || RSA[PRA, H(M||S)] (cleartext, hash is known to attacker, non-repudiable cuz private keys were used)
- E[K,M] || RSA[PRA, H(M||S)] (cleartext, hash known to attacker, non-repudiable)
- E[K, M || RSA[PRA, H(M||S)]] (same as above but more overhead)
Key exchange using RSA:
- RSA[PUB, KS] || E[KS, M] || RSA[PRA, H(M||S)] (all's good)
- RSA[PUB, KS] || E[KS, M || RSA[PRA, H(M||S)]] (double-enc overhead)
DSA
- Public parameters are a prime \(p\), \(q\) which is a divisor of \(p - 1\), and \(g = h^{\frac{p-1}{q}} \mod p\) where \(h\) is any integer below \(p - 1\).
- Private key, a random \(x, 0 < x < q\), public key, \(y = g^x \mod p\)
- Signing and verification are too complex for my smooth brain to wrap my head around.
