2
$\begingroup$

I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is:

  • How I will be able to formalize the SHA-1 hash function using keys?
  • In security proof, which approach could be used - theoretical or practical?
$\endgroup$
2
  • 1
    $\begingroup$ cs.ucdavis.edu/~rogaway/papers/ignorance.pdf $\;$ $\endgroup$
    – user991
    Nov 12, 2013 at 15:19
  • $\begingroup$ @RickyDemer yes I'm reading that paper, and I understand the follow: In the practice is used hash functions without keys. In practice a function F is free-collision if not exists efficient algorithm know to man that outputs a collision in F. But in the theory (keyed hash functions), collision free is defined than not exists person such that is able to found collisions. But for me is the same ... My deduction is wrong? $\endgroup$
    – juaninf
    Nov 12, 2013 at 16:41

1 Answer 1

3
$\begingroup$

We are talking about hash-function families $\{h_k\}_{k\in K}$ here. The parameter $k$ is used to rule out the trivial collision search algorithm that simply prints a collision for a given $h$ (such algorithms exist, but are difficult to find). For large $K$ such an algorithm would be too large. The parameter $k$ is called a key, but it is not actually secret.

The issue is that concrete hash-functions are unkeyed. This is not a problem in practice, since such ``printing'' algorithms are never found. However, to prove the security of a protocol that uses such a hash function, one needs to show a proper reduction: the protocol is secure as long as the hash function is collision free. The latter is easily formulated for keyed hash functions, but for a single hash function it has been formalized rather recently. This answers your second question.

For the first question, there is no standard way of making a keyed hash function out of SHA-1, because this is not needed in practice. One may think of HMAC-SHA-1, but I doubt its collision resistance when the key is known (it is probably reduced to the chosen-prefix attack).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.