hash functions hash functions
play

Hash Functions Hash Functions Lecture 10 Hash Functions Lecture - PowerPoint PPT Presentation

Hash Functions Hash Functions Lecture 10 Hash Functions Lecture 10 Before we talk about digital signatures... A Tale of Two Boxes A Tale of Two Boxes Much of today s applied cryptography works with two magic boxes A Tale of Two Boxes


  1. Degrees of Collision-Resistance If for all PPT A, Pr[x ≠ y and h(x)=h(y)] is negligible in the following experiment: A → (x,y); h ← H : Combinatorial Hash Functions (even non-PPT A) A → x; h ← H ; A(h) → y : Universal One-Way Hash Functions h ← H ; A(h) → (x,y) : Collision-Resistant Hash Functions Also useful sometimes: A gets only oracle access to h(.) (weak). Or, A gets any coins used for sampling h (strong).

  2. Degrees of Collision-Resistance If for all PPT A, Pr[x ≠ y and h(x)=h(y)] is negligible in the following experiment: A → (x,y); h ← H : Combinatorial Hash Functions (even non-PPT A) A → x; h ← H ; A(h) → y : Universal One-Way Hash Functions h ← H ; A(h) → (x,y) : Collision-Resistant Hash Functions Also useful sometimes: A gets only oracle access to h(.) (weak). Or, A gets any coins used for sampling h (strong). CRHF the strongest; UOWHF still powerful (will be enough for digital signatures)

  3. Degrees of Collision-Resistance

  4. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random)

  5. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed)

  6. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed) Pre-image collision resistance if h(x)=h(y) w.n.p

  7. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed) Pre-image collision resistance if h(x)=h(y) w.n.p i.e., f(h,x) := (h,h(x)) is a OWF (and h compresses)

  8. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed) One-Way Hash A.k.a Pre-image collision resistance if h(x)=h(y) w.n.p Function i.e., f(h,x) := (h,h(x)) is a OWF (and h compresses)

  9. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed) One-Way Hash A.k.a Pre-image collision resistance if h(x)=h(y) w.n.p Function i.e., f(h,x) := (h,h(x)) is a OWF (and h compresses) h ← H ; x ← X; A(h,x) → y (y ≠ x)

  10. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed) One-Way Hash A.k.a Pre-image collision resistance if h(x)=h(y) w.n.p Function i.e., f(h,x) := (h,h(x)) is a OWF (and h compresses) h ← H ; x ← X; A(h,x) → y (y ≠ x) Second Pre-image collision resistance if h(x)=h(y) w.n.p

  11. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed) One-Way Hash A.k.a Pre-image collision resistance if h(x)=h(y) w.n.p Function i.e., f(h,x) := (h,h(x)) is a OWF (and h compresses) h ← H ; x ← X; A(h,x) → y (y ≠ x) Second Pre-image collision resistance if h(x)=h(y) w.n.p Incomparable (neither implies the other) [Exercise]

  12. Degrees of Collision-Resistance Weaker variants of CRHF/UOWHF (where x is random) h ← H ; x ← X; A(h,h(x)) → y (y=x allowed) One-Way Hash A.k.a Pre-image collision resistance if h(x)=h(y) w.n.p Function i.e., f(h,x) := (h,h(x)) is a OWF (and h compresses) h ← H ; x ← X; A(h,x) → y (y ≠ x) Second Pre-image collision resistance if h(x)=h(y) w.n.p Incomparable (neither implies the other) [Exercise] CRHF implies second pre-image collision resistance and, if compressing, then pre-image collision resistance [Exercise]

  13. Hash Length

  14. Hash Length If range of the hash function is too small, not collision-resistant

  15. Hash Length If range of the hash function is too small, not collision-resistant If range poly-size (i.e. hash log-long), then non-negligible probability that two random x, y provide collision

  16. Hash Length If range of the hash function is too small, not collision-resistant If range poly-size (i.e. hash log-long), then non-negligible probability that two random x, y provide collision In practice interested in minimizing the hash length (for efficiency)

  17. Hash Length If range of the hash function is too small, not collision-resistant If range poly-size (i.e. hash log-long), then non-negligible probability that two random x, y provide collision In practice interested in minimizing the hash length (for efficiency) Generic collision-finding attack: birthday attack

  18. Hash Length If range of the hash function is too small, not collision-resistant If range poly-size (i.e. hash log-long), then non-negligible probability that two random x, y provide collision In practice interested in minimizing the hash length (for efficiency) Generic collision-finding attack: birthday attack Look for a collision in a set of random hashes (needs only oracle access to the hash function)

  19. Hash Length If range of the hash function is too small, not collision-resistant If range poly-size (i.e. hash log-long), then non-negligible probability that two random x, y provide collision In practice interested in minimizing the hash length (for efficiency) Generic collision-finding attack: birthday attack Look for a collision in a set of random hashes (needs only oracle access to the hash function) Expected size of the set before collision: O( √ |range|)

  20. Hash Length If range of the hash function is too small, not collision-resistant If range poly-size (i.e. hash log-long), then non-negligible probability that two random x, y provide collision In practice interested in minimizing the hash length (for efficiency) Generic collision-finding attack: birthday attack Look for a collision in a set of random hashes (needs only oracle access to the hash function) Expected size of the set before collision: O( √ |range|) Birthday attack effectively halves the hash length (say security parameter) over “naïve attack”

  21. Universal Hashing

  22. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p

  23. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p Even better: 2-Universal Hash Functions

  24. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p Even better: 2-Universal Hash Functions “Uniform” and “Pairwise-independent”

  25. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p Even better: 2-Universal Hash Functions “Uniform” and “Pairwise-independent” ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z)

  26. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1

  27. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2

  28. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z|

  29. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range

  30. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range k-Universal:

  31. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range k-Universal: ∀ x 1 ..x k (distinct), z 1 ..z k , Pr h ← H [ ∀ i h(x i )=z i ] = 1/|Z| k

  32. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range k-Universal: ∀ x 1 ..x k (distinct), z 1 ..z k , Pr h ← H [ ∀ i h(x i )=z i ] = 1/|Z| k Inefficient example: H set of all functions from X to Z

  33. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range k-Universal: ∀ x 1 ..x k (distinct), z 1 ..z k , Pr h ← H [ ∀ i h(x i )=z i ] = 1/|Z| k Inefficient example: H set of all functions from X to Z But we will need all h ∈ H to be succinctly described and efficiently evaluable

  34. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range

  35. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h a,b (x) = ax+b (in a finite field, X=Z)

  36. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h a,b (x) = ax+b (in a finite field, X=Z) Pr a,b [ ax+b = z ] = Pr a,b [ b = z-ax ] = 1/|Z|

  37. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h a,b (x) = ax+b (in a finite field, X=Z) Pr a,b [ ax+b = z ] = Pr a,b [ b = z-ax ] = 1/|Z| Pr a,b [ ax+b = w, ay+b = z] = ? Exactly one (a,b) satisfying the two equations (for x ≠ y)

  38. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h a,b (x) = ax+b (in a finite field, X=Z) Pr a,b [ ax+b = z ] = Pr a,b [ b = z-ax ] = 1/|Z| Pr a,b [ ax+b = w, ay+b = z] = ? Exactly one (a,b) satisfying the two equations (for x ≠ y) Pr a,b [ ax+b = w, ay+b = z] = 1/|Z| 2

  39. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h a,b (x) = ax+b (in a finite field, X=Z) Pr a,b [ ax+b = z ] = Pr a,b [ b = z-ax ] = 1/|Z| Pr a,b [ ax+b = w, ay+b = z] = ? Exactly one (a,b) satisfying the two equations (for x ≠ y) Pr a,b [ ax+b = w, ay+b = z] = 1/|Z| 2 But does not compress!

  40. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range

  41. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h’ h (x) = Chop(h(x)) where h from a 
 (possibly non-compressing) 2-universal HF

  42. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h’ h (x) = Chop(h(x)) where h from a 
 (possibly non-compressing) 2-universal HF Chop a t-to-1 map from Z to Z’ (e.g. removes last bit: 2-to-1)

  43. Universal Hashing Combinatorial HF: A → (x,y); h ← H . h(x)=h(y) w.n.p x h 1 (x) h 2 (x) h 3 (x) h 4 (x) Even better: 2-Universal Hash Functions 0 0 0 1 1 “Uniform” and “Pairwise-independent” 1 0 1 0 1 ∀ x,z Pr h ← H [ h(x)=z ] = 1/|Z| (where h:X → Z) 2 1 0 0 1 ∀ x ≠ y,w,z Pr h ← H [ h(x)=w, h(y)=z ] = 1/|Z| 2 ⇒ ∀ x ≠ y Pr h ← H [ h(x)=h(y) ] = 1/|Z| Negligible collision-probability if super-polynomial-sized range e.g. h’ h (x) = Chop(h(x)) where h from a 
 (possibly non-compressing) 2-universal HF Chop a t-to-1 map from Z to Z’ (e.g. removes last bit: 2-to-1) Pr h [ Chop(h(x)) = w, Chop(h(y)) = z] 
 = Pr h [ h(x) = w0 or w1, h(y) = z0 or z1] = 4/|Z| 2 = 1/|Z’| 2

  44. UOWHF

  45. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p

  46. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF

  47. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF

  48. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF F h (x) = h(f(x)), where f is a OWP and h from a UHF family

  49. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF F h (x) = h(f(x)), where f is a OWP and h from a UHF family s.t. h compresses by a bit (i.e., 2-to-1 maps), and

  50. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF F h (x) = h(f(x)), where f is a OWP and h from a UHF family s.t. h compresses by a bit (i.e., 2-to-1 maps), and for all z, z’, w, can solve for h s.t. h(z) = h(z’) = w

  51. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF F h (x) = h(f(x)), where f is a OWP and h from a UHF family s.t. h compresses by a bit (i.e., 2-to-1 maps), and for all z, z’, w, can solve for h s.t. h(z) = h(z’) = w Is a UOWHF [Why?]

  52. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF F h (x) = h(f(x)), where f is a OWP and h from a UHF family s.t. h compresses by a bit (i.e., 2-to-1 maps), and for all z, z’, w, can solve for h s.t. h(z) = h(z’) = w BreakOWP(z) { get x ← A; sample random w; give A h Is a UOWHF [Why?] s.t. h(z)=h(f(x))=w; if A → y s.t. h(f(y))=w, output y; }

  53. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF F h (x) = h(f(x)), where f is a OWP and h from a UHF family s.t. h compresses by a bit (i.e., 2-to-1 maps), and for all z, z’, w, can solve for h s.t. h(z) = h(z’) = w BreakOWP(z) { get x ← A; sample random w; give A h Is a UOWHF [Why?] s.t. h(z)=h(f(x))=w; if A → y s.t. h(f(y))=w, output y; } Gives a UOWHF that compresses by 1 bit (same as the UHF)

  54. UOWHF Universal One-Way HF: A → x; h ← H ; A(h) → y. h(x)=h(y) w.n.p Can be constructed from OWF Much easier to see: OWP ⇒ UOWHF F h (x) = h(f(x)), where f is a OWP and h from a UHF family s.t. h compresses by a bit (i.e., 2-to-1 maps), and for all z, z’, w, can solve for h s.t. h(z) = h(z’) = w BreakOWP(z) { get x ← A; sample random w; give A h Is a UOWHF [Why?] s.t. h(z)=h(f(x))=w; if A → y s.t. h(f(y))=w, output y; } Gives a UOWHF that compresses by 1 bit (same as the UHF) Will see later, how to extend the domain to arbitrarily long strings (without increasing output size)

  55. CRHF

  56. CRHF Collision-Resistant HF: h ← H ; A(h) → (x,y). h(x)=h(y) w.n.p

  57. CRHF Collision-Resistant HF: h ← H ; A(h) → (x,y). h(x)=h(y) w.n.p Not known to be possible from OWF/OWP alone

Recommend


More recommend