Cryptographic hash functions: analysis, design and implementation

加密哈希函数可以被认为是密码学的主力，它们散布在安全协议中。尽管如此，哈希函数可以说是最不容易理解的加密原语，而且哈希技术比加密技术开发得少得多。21世纪初的密码分析表明，广泛使用的散列函数只能提供非常有限的安全余量。当中国密码分析人员设法增强多块差分密码分析，使发现MD5的冲突变得非常容易，并且SHA-1的安全裕度大大降低时，开启了类似于MD设计的分析历史的全新篇章。在发现MD5的第一个冲突之后不久，就展示了如何使用这种冲突来误导完整性检查软件，并生成具有MD5冲突的流行格式的文档。此外，MD5冲突还用于创建非法证书颁发机构。为了应对这些引人注目的密码分析攻击，美国国家标准与技术研究所（NIST）决定开发一个或多个额外的哈希函数。因此，在2007年11月，NIST宣布启动SHA-3竞赛，以选择一个新的哈希函数族。本研究的目的是研究可证明安全哈希函数的有效族的设计和分析。特别是，我们的目标是(i)通过引入更多来自数学的合理概念来形式化哈希函数的密码分析的设计和实践（ii）产生一种理论来量化迭代哈希函数对大量密码分析攻击的抗性，以及（iii）开发一种新的替代方案，以替代当前的类md迭代结构，该结构可用于使实际哈希函数更接近随机oracle模型。本项目将研究的加密原语是学术界和工业界加密和安全社区关注的主要焦点。因此，该项目的研究结果预计将具有很高的意义，因为它对非常广泛的安全产品和应用产生了影响。

Cryptographic hash functions can be considered as the workhorse of cryptography and they are sprinkled all over security protocols. In spite of this, hash functions are arguably the least well-understood cryptographic primitives, and hashing techniques are much less developed than encryption techniques. Cryptanalysis during the early 2000s has shown that widely used hash functions offered only a very limited security margin. A completely new chapter in the history of analysis of Merkle-Damgård (MD)-like designs was opened when Chinese cryptanalysts managed to enhance multi-block differential cryptanalysis to a point that finding collisions for MD5 became very easy and a substantial reduction of the security margin was obtained for SHA-1. Soon after the first collisions for MD5 have been found, it was shown how such collisions can be used to mislead integrity checking software and to produce documents with popular formats that collide under MD5. Furthermore, MD5 collisions were also used to create a rogue certification authority. In response to these dramatic cryptanalytic attacks, the National Institute for Standards and Technology (NIST) has decided to develop one or more additional hash functions. Consequently, in November 2007, the NIST has announced the launch of the SHA-3 competition to select a new hash function family. The objective of this research is to investigate the design and analysis of efficient families of provably secure hash functions. In particular, we aim to (i) Formalize both the design and the practice of cryptanalysis of hash functions by introducing more sound concepts from mathematics (ii) Produce a theory to quantify the resistance of iterated hash functions to a large set of cryptanalytic attacks, and (iii) Develop a new alternative to the current MD-like iterative structures which can be used to bring practical hash functions closer to the random oracle model. The cryptographic primitives that will be investigated in this project are the main focus of the cryptographic and security communities from both academia and industry. Consequently, the findings of this project are expected to be of high significance because of its impact on a very wide range of security products and applications.