0
$\begingroup$

I came across an authentication system Here that uses multiple hashing algorithms to hash data in different stages of the authentication.
My question is what's the rationale behind this?
If a hashing algorithm is secure (or has been secure so far, like SHA-256) why use different ones?
For example: When someone/something is registered in the system, its registration token is generated using algorithm H0 and when it is doing some other actions in the system it uses another hashing algorithm like H1.

$\endgroup$
4
$\begingroup$

A protocol might rely on using some string $x$ as an index into a set of uniform random bit strings $H(x)$. The security of the protocol may rely on the $H(x)$ being uniform random and independent for different $x$.

A complex protocol may rely on having multiple independent uniform random bit strings for any particular string $x$, used for different purposes in the protocol. If you use the same $H(x)$ for both purposes, the security may evaporate.

Here's an example: A deduplicating encrypted storage scheme like Tahoe-LAFS needs to derive an encryption key for each file it stores, and needs to choose a storage index that depends only on the content. Using a single hash function for both—$H(x)$ as the encryption key, and $H(x)$ as the storage index—is a fatal mistake: a malicious storage server can now decrypt every file you store on it. But using two different hash functions prevents this: knowledge of the storage index $H_1(x)$ doesn't help to find the encryption key $H_0(x)$.

In practical terms, we implement $H_0$ and $H_1$ in terms of a single hash function with a specially formatted input for ‘domain separation’: $H_n(x) := H(n \mathbin\| x)$, where $n$ is some prefix-free encoding of an integer as a bit string—say the 32-bit little-endian encoding.

$\endgroup$
  • $\begingroup$ So if I understand correctly we either keep those "other" hashing functions secret or we use the same hash function but append some prefix to the input, right? $\endgroup$ – Abol_Fa Nov 6 '19 at 17:46
  • $\begingroup$ Nothing about secrets here, just about domain separation to create what are effectively independent hash functions that bear no distinguishable relation to one another. $\endgroup$ – Squeamish Ossifrage Nov 6 '19 at 17:48
  • $\begingroup$ Of course, if you had one secret hash function like HMAC-SHA256 under a secret key, you could use that to invent many secret hash functions by doing $\operatorname{HMAC-SHA256}_k(n \mathbin\| x)$ much the same way. (Exactly what ‘secret hash function’ means here depends on the nature of the protocol in question.) $\endgroup$ – Squeamish Ossifrage Nov 6 '19 at 17:49
0
$\begingroup$

The authentication system you are asking about does not mandate different hashing algorithms.

$H_0$, $H_1$... $H_n$ can, for example, be implemented with SHA3 in the following way : $H_n(x) = SHA3(n \mathbin\| x)$, the operator $\mathbin\|$ being a concatenation.

$H_0$, $H_1$... $H_n$ are said to be different hashing functions from the same family of functions.

For example, when building the functions $H_0$ and $H_1$ with the SHA3-256 algorithm:

SHA3-256("0foobar") = 0x6AE907DB1BF67E79989E8EFEC7E26D060357FFEF12E703813AAC2FDB7A272F4B
SHA3-256("1foobar") = 0x394D2BB1377F3383AF959E526171C04D5DDB3D6B0E57CC5E02FCFB8EC251CE7F

Thus $H_0({foobar}) \neq H_1({foobar})$. This proves that those two functions are different, despite using the same underlying algorithm.

$\endgroup$
  • $\begingroup$ But in the text it says ... and five secure hashing functions are H0,H1,H2,H3,H4 @A. Hersean $\endgroup$ – Abol_Fa Nov 6 '19 at 14:49
  • $\begingroup$ Yes, the functions H0, H1... H5 are effectively 5 different hash functions, of the same family (SHA3, or HMAC-SHA256 for example). H0("foobar") and H1("foobar") produce two different outputs, proving they are different functions. $\endgroup$ – A. Hersean Nov 6 '19 at 15:05
  • $\begingroup$ @ A. Hersean that's exactly my question. why would they use different hashing algorithms while they could've used just one? $\endgroup$ – Abol_Fa Nov 6 '19 at 15:12
  • $\begingroup$ They use one family of functions because, as you correctly stated, it is useless to use different families. However, it is a common pattern (a best practice) to one function per usage, to avoid the computations made at one stage to be used in a clever way by an attacker at another stage. Even when such an attack has not yet been published. This counter measure costs almost nothing to implement and do not increase the complexity, and has prevented replay and collision attacks in the past. $\endgroup$ – A. Hersean Nov 6 '19 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.