Chapter 3: One-way Hash Functions

A one-way hash function is a cryptographic algorithm that turns an arbitrary-length input into a fixed-length binary value, and this transformation is one-way, that is, given a hash value it is statistically infeasible to come up with a document that would hash to this value. Also it is virtually impossible to find two different documents that hash to the same value (such a pair of documents is referred to as a "collision".)

There are three widely used hash algorithms: MD5, SHA and SHA-256. MD5 produces a 128-bit hash, SHA a 160-bit hash, and SHA-256 a 256-bit hash.

Note: As of 2005, MD5 is no longer considered secure for digital signing purposes as it has been shown to lack collision resistance. However, it is still widely used in various security protocols and applications for key generation purposes.

MD5 and SHA are supported by all cryptographic providers, while SHA-256 is only supported by the Microsoft Enhanced RSA and AES Cryptographic Provider.

This chapter will describe two practical applications for one-way hash functions: secure password storage and file "fingerprinting".

• Create a CryptoHash object.
• Add a text string or file to it. This step may be repeated several times.
• Retrieve the result in a desired format (Hex, Base64 or binary.)

The following code snippet computes the SHA hash value of the string "some text":

The CreateHash method accepts an optional HashAlgorithm argument. It is calgSHA by default.

To calculate SHA-256, we need to pass the appropriate parameter (calgSHA256) to CreateHash, and also use OpenContextEx to connect to the Microsoft Enhanced RSA and AES Cryptographic Provider:

The Hash.Value property returns a CryptoBlob object containing the computed hash value. This blob object can be queried using the Hex, Base64 or Binary properties as described in previous chapters.

Once the hash value is retrieved from the CryptoHash object, you can no longer call AddText on it until the object is reset by calling the Reset method. This way, multiple hash values can be calculated using the same CryptoHash object.

3.3.1 Hashing the Passwords

Let us consider an application where we need to maintain a database of usernames and passwords. Naturally, the passwords need to be stored in a secure manner: even if the database is hacked into or stolen, the passwords should still be hard for the perpetrator to retrieve.

Storing the passwords in clear text is, obviously, unacceptable. Encrypting the passwords with a symmetric cipher is better but still not perfect: symmetric encryption requires a key, and the security of that key can be compromised. Besides, the passwords would still be accessible to the developers and system administrators involved with the application, which to a certain extent violates user privacy.

Using a one-way hash function solves these problems. Instead of storing the password itself, we will store its hash value. To authenticate a user, the password he submits during login is also hashed and compared with the value stored in the database. If the values match the user is authenticated.

This approach keeps the passwords safe even if the database is compromised, requires no keys, and respects user privacy. However, it has one drawback: a forgotten password cannot be recovered, only reset.

3.3.2 Preventing Dictionary Attacks with Salt

Even a hash-encrypted password database is not entirely secure. A hacker can compile a list of, say, 1,000,000 most commonly used passwords and compute a hash function from all of them. He can then get hold of your user account database and compare the hashed passwords in the database with his own list to see what matches. This is a dictionary attack and it can be very successful.

To make the dictionary attack more difficult, salt is used. Salt is a random string that is concatenated with passwords before being operated on by the hash function. The salt value is then stored in the user database together with the result of the hash function. Using salt makes dictionary attacks practically impossible as a hacker would have to compute the hashes for all possible salt values. However, salt does not help make attacks on individual passwords any harder, therefore it is important to use passwords that are hard to guess.

3.3.3 Sample Application

The following two code samples illustrate the use of hash in a user account management application: the first one adds a user account to the database, and the second authenticates a user against the database.

The sample database aspencrypt.mdb included with the installation contains the table Users with the following simple layout:

The following code sample adds a new user account:

For the sake of brevity, the username uniqueness check has been omitted from this code sample.

Click the links below to run this code sample:

http://localhost/aspencrypt/manual_03/03_addusers.asp http://localhost/aspencrypt/manual_03/03_addusers.aspx

The following code sample authenticates a user against the database:

Click the links below to run this code sample:

http://localhost/aspencrypt/manual_03/03_validate.asp http://localhost/aspencrypt/manual_03/03_validate.aspx  

Since it is practically impossible to find two documents that would have the same hash value, a document's hash, often referred to as a "fingerprint", can be used to uniquely identify this document. If you are developing a document repository, such as a database of images, and want to prevent the same document to appear in your database twice, you can store the document's thumbprint together with the document itself. This way, every time a new document is to be added you can easily check whether it already exists in your database by computing the new file's hash value and looking for a match in your database.

To calculate the hash value of a file, the method AddFile of the CryptoHash object should be used. This method accepts the physical path to the file being hashed:

The CryptoHash object can also be used to compute the hash value of a binary array via the method AddBinary.

3.5.1 What is HMAC?

The Message Authentication Code (MAC) function is essentially a hash function with two arguments instead of one: a secret key and an arbitrary-length message. The MAC protects both the message's data integrity and authenticity. For the MAC to work, all parties involved in the secure exchange of messages must share a secret key.

Conceptually, the MAC is simply a hash function applied to the secret key and message concatenated together, as follows (the "+" sign denotes concatenation):

MAC(Secret, Message) = Hash(Secret + Message)

The MAC is then sent alongside the message. The whole "envelope" is often encrypted.

The recipient of the MAC-equipped message concatenates his own copy of the secret key with the message and computes his own MAC. If the MAC values match, the message is authenticated and its data integrity is verified. A MAC is therefore similar to a digital signature but is based on the shared knowledge of a secret key instead of public-key cryptography.

In a real world, the simple formula shown above is not used as it is vulnerable to various cryptographic attacks. A more complicated formula, referred to as HMAC, is used instead. HMAC uses two nested invocations of the hash functions as well as two concatenations and two XOR operations, as follows:

HMAC(Secret, Message) = Hash((Secret ^ opad) + Hash((Secret ^ ipad) + Message))

The "^" symbol denotes a bitwise XOR operation, and opad and ipad are byte sequences 0x5c5c5c... and 0x363636... respectively.

The HMAC function is considered secure and resistant to most cryptographic attacks. It is heavily used in the Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols, among other areas.

HMAC can be based on any hash algorithm such as MD5, SHA or SHA256. The HMAC functions based on MD5, SHA, etc. are often denoted as HMAC_MD5, HMAC_SHA, etc. The length of the HMAC output equals that of the underlying hash function (16 bytes for HMAC_MD5, 20 bytes for HMAC_SHA, etc.)

3.5.2 AspEncrypt's HMAC Support

Starting with Version 2.6, AspEncrypt is capable of computing the HMAC function via the CryptoContext method ComputeHmac. This method expects a hash algorithm such as calgMD5 or calgSHA as the first argument, and CryptoBlob objects containing the secret key and message as the 2nd and 3rd arguments, respectively. The method returns an instance of the CryptoBlob object populated with the HMAC value.

The following code snippet computes the HMAC_MD5 and HMAC_SHA functions of the secret "my secret key" and message "Hello World!!!". Note that HMAC_SHA256, HMAC_SHA384 and HMAC_SHA512 require the Microsoft Enhanced RSA and AES Cryptographic Provider.

The expected result is: