2
$\begingroup$

I've been looking all over the internet for an answer, and I must not know how to search because I've been really surprised that I haven't been able to find one. I'd also love to know what makes a block cipher a good candidate for being the basis of a hash function.

Thanks!

Improve this question
$\endgroup$
4
  • $\begingroup$ You don't show that you have done any efforts. If you have found any articles about hash functions, explain what you have understood and what have you not. You cannot expect thatan answer here will replace an article or a book. $\endgroup$
    – mentallurg
    Dec 18, 2020 at 2:31
  • $\begingroup$ I don't know if it works, but you can try searching on an acedemic search engine (Google and Bing has ones of their own) about the 3 tags you've used in this question. And if there are relevant results, you can look for cryptanalysis articles. $\endgroup$
    – DannyNiu
    Dec 18, 2020 at 4:13
  • $\begingroup$ @mentallurg I understand how the Merkle-Damgård construction is used to build hash functions from compression functions, and how the Davies-Meyer construction is used to build compression functions from block ciphers. I must have looked at 5 different papers about hash functions at this point, and I've found that DES and LOKI have been used, but still no explanation of why. Guess I'll have to look harder. $\endgroup$
    – Adar Kahiri
    Dec 18, 2020 at 5:32
  • $\begingroup$ @DannyNiu I'll give that a shot. Thanks! $\endgroup$
    – Adar Kahiri
    Dec 18, 2020 at 5:33

1 Answer 1

Reset to default
5
$\begingroup$

Block ciphers used in hash functions built per the Merkle-Damgård structure with a Davies-Meyer compression function (e.g. MD5, SHA-1, and SHA-2) have special requirements:

  • They must have a wide block (data input and output): as wide as the hash, thus twice the security (in bits) if collision-resistance is a consideration. For 128-bit security, we thus need a block cipher with a 256-bit block. This disqualifies all three variants of AES, and many earlier block ciphers.
  • They must be immune to related-key attacks, which normally are of secondary concern in block ciphers. This disqualifies DES when viewed as a 64-bit key block cipher (and makes it clumsy when viewed as a 56-bit block cipher), and TEA (Microsoft used it anyway in the original Xbox, and got pwned).
  • For best efficiency, they need a wide key input (at least twice the block size is typical), and high key agility (low computational effort to change the key). This disqualifies some block ciphers.

The block ciphers used thus tend to be built for the specific use, and designated as the block cipher of their associated hash. An example is SHACAL.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ Moving to a bigger block size has other advantages - modes of operation may suffer from collisions as well e.g. when it comes to the CTR counter, so maybe we see some future convergence happening. For now AES obviously rules supreme... $\endgroup$
    – Maarten Bodewes ♦
    Dec 18, 2020 at 9:36
  • $\begingroup$ @MaartenBodewes: yes. The Rijndael submission allows wider blocks for an excellent reason. $\endgroup$
    – fgrieu ♦
    Dec 18, 2020 at 9:47
  • $\begingroup$ Exactly the answer I was looking for. Thank you so much! $\endgroup$
    – Adar Kahiri
    Dec 18, 2020 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.