Verified Security of Merkle-Damgård

Abstract

Cryptographic hash functions provide a basic data authentication mechanism and are used pervasively as building blocks to realize many cryptographic functionalities, including block ciphers, message authentication codes, key exchange protocols, and encryption and digital signature schemes. Since weaknesses in hash functions may imply vulnerabilities in the constructions that build upon them, ensuring their security is essential. Unfortunately, many widely used hash functions, including SHA-1 and MD5, are subject to practical attacks. The search for a secure replacement is one of the most active topics in the field of cryptography. In this paper we report on the first machine-checked and independently-verifiable proofs of collision-resistance and indifferentiability of Merkle-Damgård, a construction that underlies many existing hash functions. Our proofs are built and verified using an extension of the EasyCrypt framework, which relies on state-of-the-art verification tools such as automated theorem provers, SMT solvers, and interactive proof assistants.

Open problems in hash function security

“…These smaller problems often show similarities, and automated proof techniques will likely contribute to an easier and more convincing validation of proofs. Rogaway and Steinberger [113] developed an automated proof technique to analyze permutation based compression functions, and similarly, automated techniques have been developed for the indifferentiability of the Merkle-Damgård hash function research by Backes et al [11] and Daubignard et al [38]. Indifferentiability proofs for hash functions will definitely benefit from automated techniques because they tend to be intricate and difficult to verify.…”

Machine-Checked Proofs for Cryptographic Standards

“…EasyCrypt [11] is an interactive proof assistant, which also embeds a simple probabilistic programming language, pWhile, used to model cryptographic primitives, schemes, oracles and experiments, as well as program logics for bounding the probability of events in programs, and for proving equivalences or approximate equivalences between programs. Although EasyCrypt was initially designed to capture Shoup's code-based game-based proof methodology [32], it has since successfully been applied to simulationbased proofs, and to a growing body of standard symmetric primitives [3,8,9]. Both of these make it a suitable candidate for this formalization effort.…”

“…A proof trick: indirection. To do so, we deploy an indirection technique similar to that used by Backes et al [8] in proving indifferentiability of Merkle-Damgård. First, each fresh permutation query (made by the adversary or the functionality) is tagged with its sequence number.…”

“…The optimizations used in these implementations are well-known and follow the general approach adopted in OpenSSL, which in turn builds on observations by the proposers of Keccak. 8 The main difference here is that they can be expressed in Jasmin, which permits reasoning about their correctness at a convenient level of abstraction.…”

Automation and Modularity of Cryptographic Proofs in the Computational Model

“…Essentially, the language and the logic are similar to the one used in CertiCrypt, but proof obligations are collected and sent to SMT solvers, therefore leveraging on extensive work on automated theorem proving. The tool was effectively used to prove the Cramer-Shoup public key encryption scheme secure against adaptive chosen-ciphertext attacks under standard assumptions, a new redundancy free encryption scheme coined ZAEP [21] and the Merkel-Damgård construction [6].…”