CAREER: Design Principles for Cryptographic Hash Functions: Foundations, Primitives, and Transforms

密码哈希函数在现代密码学中无处不在。它们是数字签名和公钥加密方案、访问控制机制、数字时间戳程序、消息认证代码和文件同步实用程序的组成部分。它们在销售点终端、atm机、操作系统、web浏览器、路由器和移动电话中实现，仅举几例。然而，哈希函数的设计和分析却很少受到密码学社区的关注，最近对常用的MD5和SHA-1哈希函数的高调攻击突显了这一缺点。这项工作旨在通过发展三个互补的主题，在理论和实践中提高我们对加密哈希函数的理解。首先，它进一步夯实了哈希的形式基础。这意味着要建立新的、有意义的概念，以确定哈希函数是“好的”。此外，它还探讨了新的分析框架的力量和局限性（例如，不可微性和人类无知），并寻找设计启发式的清晰视图（特别是随机-oracle和dideal-cipher模型）。其次，它研究了“小”哈希函数的设计，称为压缩函数，具有小域和固定范围。基于排列、分组密码和可调整分组密码的设计特别有趣。第三，开发了将压缩函数转换为具有灵活域和范围的“大”哈希函数的方法；传统上，哈希函数的范围是一个固定长度的字符串。在存在错误的情况下，将多个原语的输出组合在一起以保证安全。

Cryptographic hash functions are ubiquitous in modern cryptography.They are an integral part of digital signature and public-keyencryption schemes, access control mechanisms, digital time-stampingroutines, message authentication codes, and file synchronizationutilities. They are implemented in point-of-sale terminals, ATMmachines, operating systems, web browsers, routers, and mobile phones,to name just a few. Yet the design and analysis of hash functions hasreceived relatively little attention from the cryptographic community,a shortcoming underscored by recent high-profile attacks on theoften-used MD5 and SHA-1 hash functions.This work aims to advance our understanding of cryptographic hashfunctions in theory and practice by developing three complementarythemes. First, it further solidifies the formal foundations ofhashing. This means establishing new and meaningful notions of whatmeans for a hash function to be "good". Additionally it explores thepowers and limitations of new analytic frameworks (for example,indifferentiability and human-ignorance), and search for a sharperview of design heuristics (in particular the random-oracle andideal-cipher models.) Second, it investigates the design of "small"hash functions, called compression functions, with small domains andfixed ranges. Designs based on permutations, blockciphers andtweakable blockciphers are especially interesting. Third, it developsmethods for transforming compression functions into "big" hashfunctions with flexible domains and ranges; traditionally, the rangeof a hash function is a string of a single fixed length. Alsotargetted is the problem of combining the outputs of multipleprimitives for the purpose of security preservation in the presence offaults.