Robust Multi-Property Combiners for Hash Functions
Robust Multi-Property Combiners for Hash Functions
复制标题
DOI：
10.1007/s00145-013-9148-7
复制
发表时间：
2013-03
影响因子：
3
通讯作者：
M. Fischlin;Anja Lehmann;Krzysztof Pietrzak
中科院分区：
文献类型：
--
作者：
M. Fischlin;Anja Lehmann;Krzysztof Pietrzak
哈希函数的鲁棒组合器采用两个候选实现并构造一个哈希函数，只要至少一个候选实现是安全的，该哈希函数就是安全的。到目前为止，散列函数组合器的目标只是保持一个单一的属性，如抗碰撞性或伪随机性。然而，当散列函数用于TLS等协议时，它们通常需要同时提供多个属性。因此，我们提出了鲁棒多属性组合器的概念，并详细阐述了这类组合器的不同定义。然后，我们提出了一个组合器，可证明保留（目标）的抗碰撞性，伪随机性，是一个安全的消息认证码。该组合器满足我们提出的最强概念，这要求组合函数满足至少一个底层哈希函数所满足的每个安全属性。如果底层哈希函数的输出长度为n，则组合器的输出长度为2n。这基本上与黑盒组合器的已知下限相匹配，仅用于抗碰撞，因此可以在不惩罚哈希值长度的情况下实现其他属性。然后，我们提出了一个组合器，它也保持了不可微的属性从一个随机预言，稍微增加输出长度为2n+ω（logn）。此外，我们展示了如何增强我们的结构，以使它们也具有鲁棒性的单向性，但在这种情况下，需要一个先验上界的输入长度。
A robust combiner for hash functions takes two candidate implementations and constructs a hash function which is secure as long as at least one of the candidates is secure. So far, hash function combiners only aim at preserving a single property such as collision-resistance or pseudorandomness. However, when hash functions are used in protocols like TLS they are often required to provide several properties simultaneously. We therefore put forward the notion ofrobust multi-property combinersand elaborate on different definitions for such combiners. We then propose a combiner that provably preserves (target) collision-resistance, pseudorandomness, and being a secure message authentication code. This combiner satisfies the strongest notion we propose, which requires that the combined function satisfies every security property which is satisfied by at least one of the underlying hash function. If the underlying hash functions have output lengthn, the combiner has output length 2n. This basically matches a known lower bound for black-box combiners for collision-resistance only, thus the other properties can be achieved without penalizing the length of the hash values. We then propose a combiner which also preserves the property of being indifferentiable from a random oracle, slightly increasing the output length to 2n+ω(logn). Moreover, we show how to augment our constructions in order to make them also robust for the one-wayness property, but in this case require an a priory upper bound on the input length.