Hashing Prefix-Free Values in Cryptographic Signature Schemes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic schemes that rely on hash functions with the Merkle-Damgård (MD) structure are vulnerable to herding attacks, which can compromise their security by allowing adversaries to solve random-prefix preimage and second-preimage problems in O(2^κ/4) time, where κ represents the security parameter, falling short of providing κ-bit security requirements.
Innovation Solution
Implementing hash functions that do not have the MD structure, such as using a block cipher-based hash function with a specific construction like H(K⊕c1∥H(K⊕c2∥m)) or employing prefix-free encoding, to resist herding attacks and maintain κ-bit security without requiring 2κ-bit outputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hash functions with Merkle-Damgård structure are used, then implementation simplicity is maintained, but security is compromised due to herding attacks
Solution Approach 1:
The patent extracts and removes the Merkle-Damgård structure from the hash function implementation. By taking out the vulnerable iterative compression function structure and replacing it with a prefix-free encoding approach, the security vulnerability to herding attacks is eliminated while maintaining cryptographic strength
Solution Approach 2:
The patent changes the fundamental parameter of hash function construction from iterative compression (Merkle-Damgård) to prefix-free encoding. This parameter change transforms the security model, providing κ-bit security without requiring 2κ-bit outputs, thereby resolving the contradiction between security and structural complexity
2Reliability
If κ-bit security is provided with Merkle-Damgård structure, then bandwidth efficiency is maintained, but vulnerability to herding attacks increases
Solution Approach 1:
The patent introduces prefix-free encoding as an intermediary layer between the input message and the hash function processing. This intermediary transformation ensures that no input is a prefix of another, which fundamentally prevents the herding attack mechanism from working while maintaining κ-bit security
Solution Approach 2:
Instead of using the traditional approach of iterative compression that processes messages in chunks, the patent inverts the approach by first applying prefix-free encoding to the entire message structure. This inversion of the processing order eliminates the vulnerability to herding attacks that exploit the iterative nature of Merkle-Damgård construction
Data Source
AI summary
Methods, systems, and computer programs for producing hash values are disclosed. A prefix-free value is obtained based on input data. The prefix-free value can be based on an implicit certificate, a message to be signed, a message to be verified, or other suitable information. A hash value is obtained by applying a hash function to the prefix-free value. The hash value is used in a cryptographic scheme. In some instances, a public key or a private key is generated based on the hash value. In some instances, a digital signature is generated based on the hash value, or a digital signature is verified based on the hash value, as appropriate.