CMM7XX

Hash Functions & Signatures

Session 5: Message Authentication

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Define the three critical properties of cryptographic hash functions.
  • Compare Merkle-Damgård (SHA-2) and Sponge (SHA-3) architectural constructions.
  • Understand the mechanics of Message Authentication Codes (HMAC).
  • Analyze Length Extension Attacks against naive hashing implementations.
  • Deconstruct Digital Signature Algorithms (DSA, ECDSA) and Non-Repudiation.

Task 1: Collision & Avalanche Test

Timing: 45 minutes

Using Python's hashlib:

  1. Define a string $M_1$: "The quick brown fox jumps over the lazy dog"
  2. Define $M_2$: "The quick brown fox jumps over the lazy cog" (1 letter difference).
  3. Compute the SHA-256 hash for both strings (in binary representation).
  4. Write a function to compute the Hamming Distance between the two binary digests (count how many bits differ).
  5. Divide the Hamming distance by 256 (the hash length). Is the percentage close to 50%?

Digital Signatures (Non-Repudiation)

MACs use symmetric keys, so both parties can generate the MAC. This cannot provide non-repudiation (proof of origin). We must use Asymmetric Cryptography.

The Mechanism

  1. Alissa hashes her document: $H = Hash(Doc)$.
  2. Alissa encrypts $H$ with her Private Key. This encrypted hash is the Signature.
  3. Bob decrypts the Signature using Alissa's Public Key to recover $H$.
  4. Bob independently hashes the document. If his hash matches $H$, the signature is valid.
Practical Resource: NIST FIPS 180-4: Secure Hash Standard

Introduction to Task 2

Understanding how MACs protect data integrity is crucial for securing API endpoints and cookies.

We will simulate an API request tampering scenario to demonstrate why naive hashing fails and why HMAC is required.
Practical Resource: NIST FIPS 180-4: Secure Hash Standard

Task 2: HMAC Forgery Analysis

Timing: 50 minutes

Assume an API authenticates requests using a naive hash: hash = SHA256(secret_key + "user=guest")

  1. Using Python, construct a simulation of this vulnerable API endpoint.
  2. Demonstrate how an attacker (without knowing the secret key) can use a tool like HashPump or write a script to generate a valid hash for "user=guest&user=admin".
  3. Refactor the API endpoint to use Python's hmac module instead.
  4. Verify that the length extension attack now fails against the HMAC implementation.
Practical Resource: NIST FIPS 180-4: Secure Hash Standard

Summary & Next Steps

  • Hashes provide Integrity. MACs provide Integrity + Authenticity. Digital Signatures provide Integrity + Authenticity + Non-Repudiation.
  • Always use standard constructions (HMAC) rather than attempting to mix keys and hashes manually.
Next Week: Authentication and Access Control (Identity Management)
Practical Resource: NIST FIPS 180-4: Secure Hash Standard