International Journal of Computer Applications (0975 – 8887)

Volume 81 – No1, November 2013

Design and Analysis of a New Hash Algorithm with Key

Integration
Richa Purohit (Arya) Upendra Mishra, Ph. D Abhay Bansal, Ph. D
Amity University Rajasthan, Amity University Rajasthan, Amity University Uttar Pradesh
Jaipur, India Jaipur, India Noida, India

ABSTRACT the output should also be different. Any acceptable

Message Integrity and authenticity are the primary aim with the cryptographic hash function should possess following three
ever increasing network protocols’ speed. Cryptographic Hash properties [7]:
Functions are main building block of message integrity. Many
types of hash functions are being used and developed. In this (a) Pre-Image Resistance- This is also known as one way
paper, we propose and describe a new keyed hash function. This property. A message {0,1}* → {0,1}m is pre-image
newly designed function produces a hash code of 128 bits for an resistant if from given hash value d ∈{0,1}* it is
arbitrary length input. The function also uses a key during impossible to find a message M ∈{0,1}* such that h(M) =
hashing, so any intruder that does not know key, cannot forge d i.e. from given hash value, it should be practically
the hash code, and, thus it fulfills the purpose of security, impossible to find original message.
authentication and integrity for a message in network. The paper
(b) Second Pre-Image Resistance- A hash function h: {0,1}*
discusses the algorithm for the function design, its security
→ {0,1}m is called second pre-image resistant if given a
aspects and implementation details.
message M1 ∈{0,1}* it is impossible to find another
Keywords message M2 ∈{0,1}* such that h(M1)= h(M2). i.e. there
Authentication, Integrity, Key, MAC, MD5, Security. should exist no two different messages for which final hash
value is same.
1. INTRODUCTION
(c) Collision Resistance- a hash function h: {0,1}* → {0,1}m
Hash Function is a function that takes an input of arbitrary
is called collision resistant if it is impossible to find two
length and produces output small but fixed length. Here, usually
always the input length is greater than output length. It is a messages M1 and M2 ∈{0,1}* such that h(M1)= h(M2).
technique for message integrity and if keys are used in the i.e. M1 and M2 colloid.
process, it also provides source authentication. Integrity is the Here, in second pre-image resistance, either M1 or M2 is fixed,
technique to transmit the message to receiver without any but in collision resistance both M1 and M2 can be chosen
modification or change in it. Source Authentication provides arbitrarily. Thus, a hash function that is collision resistant is
protection for messages against impersonating and tempering by always second pre-image resistance also, but reverse is not
an active deceiver. G.J. Simmons proposed a model for always true. Apart from these three properties, the hash function
authentication [1]. The model assumes three active participants- should be computationally feasible. But for increased security,
(1) a sender, (ii) a receiver and (iii) an intruder. Here, the sometimes speed of computation and execution is compromised.
intruder impersonates the sender and sends a fraudulent message
to the receiver or changes the original message sent by sender. 3. DESIGN SPECIFICATIONS FOR
Use of keyed hash function may solve this issue to the vast CRYPTOGRAPHIC HASH FUNCTIONS
extent. As, the key is known to only sender and receiver, and it Any cryptographic hash function should first of all withstand all
is being used for authentication or hash generation, then without the different possible attacks on it, and at the same time, it
knowing the actual key, the intruder or deceiver cannot create should also satisfy the requirements as stated in previous section
the new message or change the original one. Thus only sender of the paper. As we have already discussed, the input length is
and receiver may communication using this way. Use of key for arbitrary ({0, 1}* leading to infinite number of inputs) and
hash generation is known as message authentication code output is of fixed length ({0,1}m leading to few finite number of
(MAC). Moreover, the hash functions, that are used for the inputs). Thus due to mapping from infinite to finite length,
purpose of cryptography, in network security, are referred to as collision always exists in hash functions. Thus, we may modify
cryptographic hash functions specifically. our definition of requirement from “it is impossible to find two
different messages that produce same hash value” to “it should
The recent attacks on MD4 [2], MD5 [3], SHA-0 [4] and SHA-1 be very difficult to find two different messages that produce
[5] by Wang et.al have enforced research in designing new same hash value”. This difficulty should be imposed by
cryptographic hash functions and cryptanalysis of existing ones. underlying design algorithm. First of all, Yuval [8] discussed
[6]. This paper describes the design of a new hash function method of finding collisions in hash functions using the Birthday
algorithm with integration of a key. It serves the requirements of Paradox, which lead to the birthday attack. In this attack, a
message integrity and source authentication both. The proposed collision is found with probability q2 / 2n after q queries to a
algorithm offers features of simplicity as well as speed while hash function whose output is of n-bit length [9]. Apart from
implementing on processors of different bits. this, to make algorithm work fast, it must include simple
operations, such as addition, XOR, complements etc.
2. KEY CONSIDERATION FOR A Furthermore, the security of designed algorithm needs to be
SECURED HASH FUNCTION proved. Only assumptions of security may lead to failure. And it
Cryptographic hash functions not only produce a fixed size should also be a modifiable structure so that it may be modified
output from an arbitrarily long input but, for each different input,

33
 International Journal of Computer Applications (0975 – 8887)
Volume 81 – No1, November 2013

and made secure against the attacks that will be discovered in produced by application of a key too. BCM (Backward Chaining
future. Mode) [14] is a method of construction of hash families without
keying all compression function applications. EMD (Enveloped
4. RELATED WORK Merkle Damgard) [15] is another same kind of technique. One
Almost all cryptographic hash functions are based on Merkle- more variant RMX [16] combines a random salt with every
Damgard construction [10]. He proposed few steps for a general message block before sending it to compression function. This
purpose hash function generation. Those were padding, append technique makes it suitable for Digital Signature.
length, initialization of buffer, processing of message in blocks.
We may depict those steps as follows: 5. DESIGN OF PROPOSED ALGORITHM
Typically any hash function has two components: a compression
M1 M2 - -- Mℓ 10* L function and a construction. The compression function is a
mapping function that transforms a larger arbitrary-size input to
a smaller fixed-size output, and the construction is the method
Original Message Padding by which the compression function is being repeatedly called to
process a variable-length message [17]. Traditionally hash
Figure-1 Merkle-Damgard Padding Step functions are being designed without any usage of key
component. However, many a few recent attacks have been
Algorithm- Pads (M) successfully implemented on these traditional popular hash
D = M+1+64 mod m functions such as- SHA1, MD5 etc. [18, 5, 19]. As we discussed
in previous section, security of algorithm needs to be proved,
M||1||od||<M>64 → M most of the newly designed algorithms are based on previously
established and accepted designs with few modifications. If
M → M1 - - - Mℓ established design promises few security aspects, the new design
will automatically do so. In the same line, this algorithm is also
based on popular MD5 [20] design. The security notions are
assumed from MD5 construction. Furthermore, integration of
M1 M2 Mℓ key in each round of operation on individual blocks gives more
strength to the proposed algorithm against many of the known
attacks on MD5.
F F F Yℓ Let us assume an input message M of length b bits. We will use
IV following notations in the description of algorithms:
+ : addition modulo 232
Figure 2: The Merkle-Damgard Construction
<<< S: circular left shift by s bit positions
∧ : bit-wise AND
Algorithm MDF: ∧: Bit-wise OR
M → M1 - - - Mℓ
Y0 = IV
⊕ : bit-wise XOR
for i = 1 to ℓ do ¬ : bit-wise complement
yi = F(Mi, yi-1) The proposed algorithm may be divided into two phases-
preprocessing and hash calculation. The preprocessing phase is
return Yℓ
very much similar to that of MD-5 and SHA-1, involving
Deploying a new hash function includes two constructs- a padding and message length and further obtaining in m-blocks,
compression function that operates on input strings of a fixed each block of 512 bit length. The hash calculation is done on
length and then to use the cascade function to extend the each 512 bit block in iterative manner in second phase of the
compression function to string of arbitrary length[11]. To algorithm. This phase also makes use of two 64 bit keys. The
improve security aspect with hash function, a key may be used. 512 bits are then compressed into 128 bits and provided as input
For this purpose two solutions were proposed. First is for processing of next block of message. The output of
Dedicated-Key setting [12], in which a publicly keyed processing of last block of message is called as digest or hash
compression function h: {0,1}k × {0,1}n × {0,1}m → {0,1}n is value. The compression function makes use of S-Box, XOR,
accessed by a family of hash functions Ch: Κ × M → {0,1}n , addition modulo 232 and look-up tables. The use of primitive
such that Ch members are indexed by different public keys ki ∈ logical functions, which are implemented on hardware and
Κ. This approach facilitates multiple instances of same hash readily available look-up table help in increasing speed of hash
function with multiple keys. And if an attack is found on any function processing. Following are the few steps of proposed
particular instance of hash function family, which is indexed by algorithm:
a particular key, it still guarantees of safety of other instances of
hash function family, that are indexed by other keys. The only Step 1: Padding-
drawback of this approach is need for extra input, in terms of
The original message is padded so that the length of message
key, resulting in extra calculations and thus, more time, but for
after padding is congruent to 448 modulo 512 (length ≡ 448 mod
increased level of security, this extra time can be afforded [13].
512) this purpose, first bit is always 1 and remaining bits are
Another approach is Integrated –Key setting [8], which always 0. This is a compulsory step so, 1 to 512 bits may be
overcomes an important drawback of dedicated-key function, appended, depending upon the length of original message.
that is: not easily accommodation of key input by keyless
compression function. Here, we may take an approach of
processing the key only at last compression call, i.e. no need of
modifying the compression function, but last hash value will be

34
 International Journal of Computer Applications (0975 – 8887)
Volume 81 – No1, November 2013

Step 2: Append Message Length- (6,10,15,21, 6,10,15,21, 6,10,15,21, 6,10,15,21)

Step 8: Processing of message in sixteen 32-bit word (512 bit)
After padding, length of original message is appended to the
blocks-
result of step 1. This length is in 64 bit representation. After this
(a) for I = 0 to n-1 do (here, n= number of blocks)
step, the length of message is now in multiples of 512. (b) divide Mi into words W0, . . . , W15 where W0 is left
Step 3: Initialize Buffer- most word.
(c) Initialization of 4 words ABCD. Here each word is of
The algorithm uses a 128 bit buffer (4 words A, B, C and D, 32 32 bit, i.e. total length = 32 × 4 = 128 bit.
bit each), which is initialized with following hexadecimal A’ = A
values: B’ = B
C’ = C
A=01234567 D’ = D (‘ represents complement)
B=89ABCDEF (d) For t = 0 to 63 do
C=FEDCBA98 X= B+((A+ ft (B,C,D) + Wjt + Kt)<<< St
D=76543210 A=D
This step is done only for once, and then after receiving the D=C
output from first block acts as buffer for second block and so on. C=B
The final result of hashing is also stored in this. B=X
Step 4: Initialize t-table- /* end of loop in step d*/
(e) Increment of 4 words ABCD
A 64 element t-table is used in the algorithm, which is prepared A = A’ + A
by following formula for each t value (ranging from 0 to 63): B = B’ + B
32 C = C’ + C
Kt= ⌊2 ∣ sin (t+1) ∣∣ where, t is in radians.
D = D’ + D
Step 5: Four Secondary Functions- (f) Make two 64 bit blocks Y and Z from ABCD
Y = BA
The algorithm also makes use of four secondary functions f1, f2, Z = CD
f3 and f4, which produce 32 bit word from 32 bit input word. (g) Generate 64 bit key for internal keyed operation. Out
The functions take 16 values from the previously discussed t- of these 64 bits, 8 are used as parity bits and rest 56
table- bits are used as effective key. Out of this one 56 bit
key, 18 keys are generated, each of 48 bit long.
f1 (B,C,D) = (B∧C) ∨ (¬B ∧D) for t = 0 , . . . , 15 (h) Operations on Y and Z blocks- Both Y and Z are
f2 (B,C,D) =(B∧D) ∨(C ∧ ¬D) for t = 16 , . . . , 31 treated similarly. Each block is further subdivided into
two partitions- left half of Y block (Ly) and right half
f3 (B,C,D) =(B ⊕ C ⊕ D) for t = 32 , . . . , 47 of Y block (Ry), and left half of Z block (Lz) and right
f4 (B,C,D) =C ⊕ (B ∨ ¬D) for t = 48 , . . . , 63 half of Z block (Rz). Initially the right and left halves
(R and L) are permuted (swapped), i.e.
Step 6: Order of words for processing: X=L
The processing is done in 4 rounds. In each round, following L=R
sequence of words is used for processing. R=X
Round1: (j0,... , j15) = Now next L’ and R’ are produced as follows-
(0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15) L’ = L
Round2: (j16,... , j31) = R’ = L (+) f (R n-1, Kn)
(1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12) Here, (=) is addition modulo 232.
Round1: (j32,... , j47) = This process is repeated for 16 times, each time with a
(5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2) different 48 bit key K.
Round1: (j48,... , j63) = Thus, Ln= Rn-1
(0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9) Rn = Ln-1 (+) f(Rn-1, Kn)
Processing is done in blocks. Each block is of 512 bit in length. After sixteenth round of operation, again perform final
A word is of 32 bits, thus, each block is made up of 16 words permutation (swapping of left and right half), thus,
(32 × 16 = 512). X = Ln
Step 7: Shifting- Ln = R n
Shifting is done in following amounts: Rn = X
Round1: (s0,...,s15) = (here X is a 32 bit block used for permutation only.)
(7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22) Final X= X XOR K17
Round2: (s16,... , s31) = Final Y = Y XOR K18
(5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20) The algorithm for function f(R.K) is defined as follows-
Round1: (s32,... , s47) = X= E(R), applying expansion permutation and returning 48-bit
(4,11,16,23, 4,11,16,23, 4,11,16,23, 4,11,16,23) data
Round1: (s48,... , s63) = X' = X ^ k, XOR with the round key
X" = s(X'), applying S boxes function and returning 32-bit data

35
 International Journal of Computer Applications (0975 – 8887)
Volume 81 – No1, November 2013

R' = P(X"), applying the round permutation 8. IMPLEMENTATION OF THE

(i) Combine final 32 bit values of X and Y. After
combining two 64 bit blocks, Y and Z respectively, we
PROPOSED ALGORITHM
The proposed algorithm can be implemented efficiently on
get one 128 bit block. These 128 bits are again stored
different platforms. It does not require large space (for tables,
in four 32 bit words ABCD.
codes, variables etc.) if large cache memory is used, then higher
/* end of loop in step a. */
performance and better throughput can be achieved. This new
(j) After processing last 512 bit block, the final hash hash function design uses the same building blocks as MD5 and
value is in ABCD, i.e. output is always 128 bit long DES, so we can expect similar performance and space
characteristics. But compared to MD5, SHA-0, SHA-1 etc., it
digest.
provides more security by use of key. Thus, it is a better
message authentication code, which may take few seconds, more
6. SECURITY OF PROPOSED DESIGN than MD5 or SHA-1 but at the same time is stronger and less
Each individual component of the proposed algorithm has its vulnerable.
respective security criteria, that ensures us that the algorithm
is secure and collision free. We may give few arguments for 9. PERFORMANCE ANALYSIS OF
security of the algorithm: PROPOSED ALGORITHM
 Mathematically secondary functions f1, f2, f3 and f4 are We have run and tested the function for a large number of
non-invertible and non-linear. inputs. Each time a different key is generated and results in
 If individual bits of B,C and D are independent of each different hash value even for the same input. We tested the
other, then overall bits of f(B,C,D) are also independent of algorithm on number of inputs, where input is fixed to a definite
each other. It guarantees one-way property. size (say 1000 Bytes). In such a case, the execution time is
almost same as shown in Figure-3, but each time key is not the
 Each round access input words in different sequences. same. Different key is being generated even for the same input,
thus, it results in different hash value each time. (refer to figure-
 In fixed point attacks, the attacker tries to produce second
6 for sample). Similarly, we run this function for different input
pre-image or collisions by insertion of extra blocks into the
size (similar number of test cases for same input size between
input [21]. To restrict this attack, padding is done by 1 and
1000 bytes to 50000 bytes), that is shown in Figure-4. It is found
number of zeros in preprocessing phase.
that average execution time is proportional to input size (Figure-
 Each step takes input from the output of previous step. 5). But as this function is based on predefined MD5 algorithm,
Thus, changes done at any one place in any one of the there exist no method for getting original message from hash
blocks, will surely affect the final output of algorithm. value. And as we have used the concept of key for generating
Thus, no two different messages will result in same output hash value, there is no chance for adversary to compute hash
hence, proves second pre-image resistance. value for a new message and to send it to receiver for the
purpose of forging, because we assume that key is known to
 Algorithm works on basic functions, such as modular receiver and sender only.
arithmetic, XOR, addition, left shift, right shift, simple
permutation etc. Thus, it does not lead to increased time
requirement for processing. Execution time taken for input
 t-table and all 48 keys can be generated well in advance, so size 1000 bytes
function need not wait in between for table element
generation or key generation. This also helps in better
execution speed.
0.360
 Use of XOR makes sure that output depends on all bits, 0.350
rather than on neighboring ones.
0.340 Time Taken
7. KEY GENERATION AND USAGE 0.330 in Seconds
As we have discussed both Dedicated-Key setting and 0.320
Integrated-Key setting, both use fixed keys, i.e. once a key is 1 3 5 7 9 11 13 15 17 19
dedicated, it will be used for each iteration of compression samp
function. But, in the proposed solution, we will use 16 different Figure-3: Execution time taken by proposed design for
key combinations in an iteration of compression function, different input test data (of 1000 byte each)
individually on two word combinations Y and Z respectively.
Obviously this approach is more time consuming than keyless
one, and it also increases overhead for computing hash by at
least n * 2t, where n is total number of blocks and t is
computation cost for one block either Y or Z. If we run it in
parallel for both of these blocks simultaneously than
computation time will increase by only n * t. Now, the
efficiency lies in implementation of key function in hashing, and
as we have already discussed earlier, because of simpler
functions it has come out as a light weight function and will not
take much time or efforts for whole message length.

36
 International Journal of Computer Applications (0975 – 8887)
Volume 81 – No1, November 2013

argue in support of lesser speed as compared to MD5 and

1.200 RIPEMD with the fact that it is using a key in the algorithm and
thus providing more security as compared to these algorithms.
1.000
1000 Bytes 500
0.800 10000 Bytes 400
0.600 20000 Bytes 300
200
30000 Bytes
0.400 100
40000 Bytes Time (ms)
0
0.200 50000 Bytes
0.000
1 3 5 7 9 11 13 15 17 19

Figure-4: Execution Time (in Seconds) taken by proposed

design for input test data of different sizes. (The X axis
shows different input samples of same size and Y axis shows Figure 7: Comparison of execution time taken by few
execution time for these inputs) existing hash functions and proposed design

1.200
10. CONCLUSION
In this paper we proposed a new hash function algorithm that
1.000 includes a 64 bit key as an ingredient to the function. It produces
0.800 128 bit digest with a secure and simpler technique as compared
0.600 to many of the popular existing techniques. Use of key adds the
0.400 time taken in
source integration facility while creating digest just for integrity
0.200 purpose. The function has been verified and found fast by using
seconds existing tables for number of keys and S-Box.
0.000
11. REFERENCES
[1] Simmons GJ. Message Authentication with arbitration of
transmitter/receiver disputes. Advances in Cryptology-
Eurocrypt’87, Lecture Notes in Computer Science,
Springer-Verlag, Berlin; 1988; 304: 151-165.
Figure-5: Average Execution Time (in Seconds) for inputs of [2] Wang X, Feng D, Lai X, Chen H and Yu X. Cryptanalysis of
different size the hash functions MD4 and RIPEMD. In Eurocrypt'05,
LNCS Springer-Verlag 2005; 3494:1-18.
[3] Klima V. Finding MD5 Collisions on a notebook PC-using
multi message modifications. Cryptology ePrint Archive,
Report 2005. http://eprint.iacr.org/102.pdf.
[4] Wang X, Yu H, Yin Y. L. Efficient Collision Search Attacks
on SHA-0. In Crypto 2005; LNCS 3621, 1-16.
[5] Wang , Yin YL, Yu H. Finding Collisions in the Full SHA-1.
In Crypto'05, LNCS Springer-Verlag 2005; 3621:17-36.
[6] Shakeel N, Murtzaa G, Ikram N. MAYHAM- A New Hash
Function. International Journal of Network Security, 2011;
15(6): 417-425.
[7] Massierer M. Provably Secure Cryptographic Hash Function.
Ph.D. Thesis, School of Mathematics, The University of
New South Wales, submitted on December 2006.
Figure 6: Execution of 1000 input byte data (notice different [8] Mohammed S A. Al-Kuwari. Integrated-Key Cryptographic
key and varying computation time for each individual input Hash Function. Ph. Thesis submitted to University of Bath,
of same size) Department of Computer Science, September 2011.
Software implementation of the algorithm was tested on system [9] Bellare M, Tadayoshi. Hash Function Balance and its Impact
with Intel based CPUs Pentium® -4 2.66 GHz with 1GB RAM. on Birthday Attacks. Eurocrypt '04, LNCS Springer-Verlag
The comparison is given in the following table for various hash 2004 ; 3027: 401- 418..
functions tested on 1 Mb data file. It shows that the algorithm is
the third fastest output after MD5 and RIPEMD. And we may

37
 International Journal of Computer Applications (0975 – 8887)
Volume 81 – No1, November 2013

[10] Damgard I. A Design Principle for Hash Functions. [18] Wang X, Feng D, Lai X, Yu H. Collisions for hash
Crypto’89, LNCS Springer Verlag 1989; 435 : 416-427, , functions MD4, MD5, HAVAL-128 and RIPEMD.
1989. Cryptology ePrint Archive, Report 2004/1999, 2004.
[11] Walker J, Kounavis M, Gueron S, Graunke G. Recent [19] Wang X, Yu H.. How to Break MD5 and Other Hash
Contribution to Cryptographic Hash Function, Intel Functions. In Eurocrypt'05, LNCS Springer-Verlag 2005;
Technology Journal 2009: 13 (2): 80-95. 3494:19-35.
[12] Bellare M, Ristenpart T. Hash Functions in Dedicated Key [20] Public-Key Cryptography Standards (PKCS): PKCS #7:
Settings: Design Choices and MPP Transforms. ICALP’07, Cryptographic Message Syntax Standard: 3.6 Other
LNCS Springer-Verlag 2007; 4596: 399-410. Cryptographic Techniques: 3.6.6 What are MD2, MD4, and
MD5?. RSA Laboratories. Retrieved 2012-10-03.
[13] Rogaway P, Steinberger J. Constructing Cryptographic
Hash Function from Fixed-Key Blockciphers. Crypto’08. [21] Rompay B V. Analysis and Design of Cryptographic Hash
LNCS Springer-Verlag 2008; 5157: 433-450. Function, MAC Algorithms and Block Ciphers. Thesis,
Katholieke University Leuven, 2004.
[14] Endreeva E, Preneel B. A Three-Property-Secure Hash
Function. SAC ’09, LNCS Springer-Verlag 2009; 5381: [22] Mornov I. Hash Functions: Theory, Attacks and
228-244. Applications. Microsoft Research, 2005.
[15] Bellare, Ristenpart T. Multiproperty- Preserving Hash [23] Hirose S, Park JH, Yun A. A Simple Variant of the Merkle-
Domain Extension and the EMD Transform. Asiacrypt ’06, Damgard Scheme with a Permutation. Asiacrypt '08, LNCS
LNCS Springer-Verlag 2006; 4284 : 299-314. Springer-Verlag 2008; 4833 : 113-129.
[16] Halevi S, Krawczyk H. The RMX transform and Digital [24] Tirtea R. Cryptographic hash functions, trends and
Signatures. 2nd NIST Hash Workshop, 2006. challenges. Journal of Computer and System Sciences,
2009; 2: 62-65.
[17] S. Al-Kuwari. Engineering Aspects of Hash Functions. In
International Conference on Security and Management
(SAM '11), 2011.

IJCATM : www.ijcaonline.org 38