Subject: [Hash] Beginning work on truncation and salting

From: Paul Hoffman <[email-masked]>
Date: Wed, 6 Jul 2005 08:39:31 -0700

Our tentative charter has the following two issues for work:

The DSA signature algorithm requires a hash function whose output is 160
bits.  The working group will consider at least two approaches to
strengthen one-way hash functions for use in DSA:

   1) Truncate a larger one-way hash function output so that it can be
      used as a secure replacement of a shorter one-way hash function
      output.

   2) Including a random value in the hash function computation.  The
      random value used is transferred at appropriate points in the
      protocol (ideally once for each use of the hash function).  This
      approach is sometimes called a "salted" or "randomized" hash
      function.

The working group may also consider other potential solutions, and one
or more standards-track mechanism will be selected.

This would be a good time to start looking at Internet Drafts and 
external references to both issues. In specific:

- Are there papers that focus on truncation? Are there explanations 
or proofs that show that simple truncation is sufficient? Or that it 
definitely is not sufficient?

- There are probably many methods for including random values in 
hashes. The one I know of in the IETF is 
<http://www.ietf.org/internet-drafts/draft-irtf-cfrg-rhash-00.txt> by 
Shai Halevi and Hugo Krawczyk. Are there others? If so, what are the 
similarities and differences?

- Moving a bit into our longer-term work, where is the strengthening 
actually needed? Is it needed in protocols that rely on the 
preimaging and second-preimagin strength of a hash, or only in 
protocols that rely on the collision resistance?

- What other topics are relevant to this first part of our work?

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Hash mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hash