Do Broken Hash Functions Affect the Security of Time-Stamping Schemes?

  • Ahto Buldas
  • Sven Laur
Conference paper

DOI: 10.1007/11767480_4

Part of the Lecture Notes in Computer Science book series (LNCS, volume 3989)
Cite this paper as:
Buldas A., Laur S. (2006) Do Broken Hash Functions Affect the Security of Time-Stamping Schemes?. In: Zhou J., Yung M., Bao F. (eds) Applied Cryptography and Network Security. ACNS 2006. Lecture Notes in Computer Science, vol 3989. Springer, Berlin, Heidelberg

Abstract

We study the influence of collision-finding attacks on the security of time-stamping schemes. We distinguish between client-side hash functions used to shorten the documents before sending them to time-stamping servers and server-side hash functions used for establishing one way causal relations between time stamps. We derive necessary and sufficient conditions for client side hash functions and show by using explicit separation techniques that neither collision-resistance nor 2nd preimage resistance is necessary for secure time-stamping. Moreover, we show that server side hash functions can even be not one-way. Hence, it is impossible by using black-box techniques to transform collision-finders into wrappers that break the corresponding time-stamping schemes. Each such wrapper should analyze the structure of the hash function. However, these separations do not necessarily hold for more specific classes of hash functions. Considering this, we take a more detailed look at the structure of practical hash functions by studying the Merkle-Damgård (MD) hash functions. We show that attacks, which are able to find collisions for MD hash functions with respect to randomly chosen initial states, also violate the necessary security conditions for client-side hash functions. This does not contradict the black-box separations results because the MD structure is already a deviation from the black-box setting. As a practical consequence, MD5, SHA-0, and RIPEMD are no more recommended to use as client-side hash functions in time-stamping. However, there is still no evidence against using MD5 (or even MD4) as server-side hash functions.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Ahto Buldas
    • 1
    • 2
    • 3
  • Sven Laur
    • 4
  1. 1.CyberneticaTallinnEstonia
  2. 2.Tallinn University of TechnologyTallinnEstonia
  3. 3.University of TartuTartuEstonia
  4. 4.Laboratory for Theoretical Computer ScienceHelsinki University of Technology, TKKFinland

Personalised recommendations