6
$\begingroup$

I learned from Dan Boneh's course that many cryptographic primitives (prngs, stream ciphers, hashes, hmac, key derivation functions) can be built from just one a block cipher or PRF.

For example, the hash is based on a compression function which can be used to make a block cipher SHACAL-1. More generally a Hash from a block cipher using Davies-Meyer construction.

There was a question SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256) which explained some points about why AES is not suitable to base a hash on.

My question is: Is there a single block cipher or PRF (or other basic primitive) which is suitable to construct the other primitiveness from?

I looked into the simon and spec ciphers (PDF) for this purpose but they say:

We have made no effort to guard against attacks in the open-key model, and Simon and Speck have not been evaluated for use as hashes.

|improve this question
$\endgroup$
  • 2
    $\begingroup$ Threefish, obviously $\endgroup$ – Thomas Jul 10 '15 at 10:59
  • 1
    $\begingroup$ See my comment here. $\;$ $\endgroup$ – user991 Jul 10 '15 at 11:06
  • 1
    $\begingroup$ The sponge/duplex constructions such as Keccak are extremely versatile $\endgroup$ – Richie Frame Jul 10 '15 at 11:11
  • 1
    $\begingroup$ @Brennan.Tobias But you'd still have to worry about the way in which the function was built on the primitive. See: you consider BLAKE2b separate from ChaCha20, even though it's apparently derived from it. Also, I'm not sure why you felt the need to use multiple different hash primitives in the system. $\endgroup$ – cpast Jul 10 '15 at 19:07
  • 1
    $\begingroup$ Threefish can indeed be used in a lot of ways. If you use the full potential of the original specification, you get a block cipher, an arbitrary sized hash, a secure MAC, a secure KDF, two stream-ciphers (from Threefish-CTR and some Skein mode). Only password-hashing and PRNGs should use dedicated constructions, where Threefish / Skein of course could also serve as underlying construction (f.ex. for Catena or for Fortuna). $\endgroup$ – SEJPM♦ Jul 10 '15 at 19:08
6
$\begingroup$

This question is based on opinion. At least kind-of. But the variants from which one can choose are quite a few.

As for general construction the sponge construction (like Keccak / SHA-3 uses) are very versatile and can be used for many purposes, for example hashing, authenticating (= "MAC'ing"), authenticated encryption (see “General Overview of the First-Round CAESAR Candidates for Authenticated Encryption”, Version of March 14, 2015 by Farzaneh Abed, Christian Forler, and Stefan Lucks).

Of course one can also use such constructions or already exisiting construction to construct the rest, PRNGs may use hashes at some point, stream ciphers can be hashes in counter-mode, HMAC can use sponge-based hashes, KDFs can be based on sponge-based hash functions, using the arbitrary output size and tweaking the input for other parameters.

Now if you're specially looking for one cipher / hash-function which can be used without much effort in a variety of modes, I think (and others as well as the comments suggest), that Threefish is the cipher to choose. Threefish was designed as a building block for a hash-function, meaning all known attack scenarios were considered, like standard attacks and related-key attacks. Threefish and it's associated hash-function Skein can also be used in a variety of modes:

  • Threefish can of course be used as a standard block cipher. (Maybe set the tweak to $0$?)
  • Skein, which is a lightweight construction around Threefish, can be used as a standard hash-function.
  • Skein-MAC, a mode of operation for Skein, is a provably secure MAC (like HMAC).
  • Skein-HMAC, Skein can of course also be operated in the standard HMAC construction.
  • Skein-KDF, a mode of operation for Skein, is a highly customizable variant of Skein, using the fact that Skein can output arbitrary sized digests.
  • Threefish stream cipher. Threfish can be used as a standard stream cipher in CTR-mode.
  • Skein stream cipher. Skein has a mode of operation allowing it's output to be used as a stream cipher pad.
  • Skein-PRNG is proposed in the original Skein paper. I'd recommend against using it but rather use Skein and Threefish within Fortuna instead of AES and SHA-256.
  • Skein-PBKDF is a PBKDF2-like mode of operation for Skein. I'd recommend against using it but rather use scrypt, bcrypt or any of the PHC-winners (to be announced). Some of the finalists allow usage of arbitrary hash-functions, where Skein could be used.
  • Threefish authenticated encryption is a bit more tricky, but there are a few schemes that use tweakable block ciphers (like Threefish) to construct fast AEAD ciphers.
|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.