52 Things: Number 20: How are Merkle-Damgaard style hash functions constructed?

52 Things: Number 20: How are Merkle-Damgaard style hash functions constructed?

52件事：第20件：Merkle-Damgaard风格的散列函数是如何构建的？

 

This is the latest in a series of blog posts to address the list of '52 Things Every PhD Student Should Know' to do Cryptography: a set of questions compiled to give PhD candidates a sense of what they should know by the end of their first year. To finish the basic schemes section, we look at one of the most popular hash function designs...
这是一系列博客文章中的最新一篇，旨在解决“每个博士生都应该知道的52件事”做密码学：这是一组问题，旨在让博士生在第一年结束时了解他们应该知道什么。为了完成基本方案部分，我们来看看最流行的哈希函数设计之一。。。

 

A Merkle-Damgaard (MD) hash function is a hash function built by extending the domain of a collision-resistant compression function that preserves the collision resistance. This means we can take a small (and fixed) width compression function, prove it is secure and then use it to make a variable length hash function.  Whilst other methods for building hash functions exist, MD is by far the most "popular" (well, most frequently used at least!), with examples including MD5,SHA1 and SHA2. So, time to break those terms down:
Merkle-Damgaard（MD）散列函数是通过扩展保持碰撞阻力的抗碰撞压缩函数的域而构建的散列函数。这意味着我们可以使用一个小（固定）宽度的压缩函数，证明它是安全的，然后使用它来生成一个可变长度的哈希函数。虽然存在其他构建哈希函数的方法，但MD是迄今为止最“流行”的（嗯，至少是最频繁使用的！），示例包括MD5、SHA1和SHA2。所以，是时候分解这些术语了：

 

Secure Hash Function? 安全散列函数？

Traditionally, a secure hash function h should be:
传统上，安全散列函数 h 应该是：

• Pre-image resistant: given h(x), it is hard to find x.
  抗预镜像：给定 h(x) ，很难找到 x 。
• Second pre-image resistance: given x, it is hard to find y such that h(x)=h(y).
  第二个预镜像阻力：给定 x ，很难找到 y 这样的 h(x)=h(y) 。
• Collision Resistance: It is hard to find x,y such that h(x)=h(y).
  抗碰撞性：很难找到 x,y 这样的 h(x)=h(y) 。

If a hash function is collision then clearly it must be second pre-image resistant, so it is this [collision resistance] that we will focus on.
如果一个哈希函数是冲突的，那么很明显它必须是第二个图像前的抗冲突函数，所以我们将重点关注这个[抗冲突]。

Compression Function 压缩功能

A compression function f:{0,1}n×{0,1}r→{0,1}n is a function that, as the name suggest, compresses n+b-bits worth of input into an n-bit output. As you might expect, a collision resistant compression function is a compression function that is collision resistant. So, it can be thought of as a fixed input length hash function, but what happens if we want our hash function to be secure for any input length?
压缩函数 f:{0,1}n×{0,1}r→{0,1}n 是一个函数，顾名思义，它将 n+b 比特的输入压缩为 n 比特的输出。正如您所期望的，抗碰撞压缩函数是一种抗碰撞的压缩函数。因此，它可以被认为是一个固定输入长度的哈希函数，但如果我们希望我们的哈希函数对任何输入长度都是安全的，会发生什么？

The MD hash function construction
MD散列函数的构造

The MD construction provides a method for extending the domain of a fixed length compression function into a variable input length hash function. Using a compression function f as above, we are going to use the n-bit value as our internal state, and feed in r-bits each iteration (it's quite common to set r=n). To do this, we begin with an initial value (IV) and split the message M up into blocks of r bits M=M0M1⋯Mm, and then simply iterate the construction by setting:
MD结构提供了一种将固定长度压缩函数的域扩展为可变输入长度散列函数的方法。使用上面的压缩函数 f ，我们将使用 n 比特值作为内部状态，并在每次迭代中输入 r 比特（设置 r=n 是很常见的）。要做到这一点，我们从初始值（IV）开始，将消息#4分解为 r 比特 M=M0M1⋯Mm 的块，然后通过设置简单地迭代构建：

S0:=IV;i=0,…,m−1:Si+1=f(Si,Mi);h(M):=Sm

Confused? Perhaps the the following diagram will help:
困惑的也许下图会有所帮助：

Diagram of the MD construction (from Wikipedia)
MD结构图（来自维基百科）

The most important thing about the MD-construction is that if the compression function is collision resistant, then so is the overall construction (as proven by Merkle). This gives us a secure method for building hash functions out of a smaller, easier studied primitives.
MD结构最重要的一点是，如果压缩功能是抗碰撞的，那么整体结构也是如此（正如Merkle所证明的）。这为我们提供了一种安全的方法，可以用更小、更容易研究的基元构建哈希函数。

Length Extension 长度延伸

You might notice that the diagram has an extra stage that my description didn't: the "finalisation" stage. This is to prevent length extension attacks. For an example, if N is a single block (ie N∈{0,1}r) if the attacker knows h(M)=x, then he can very easily calculate h(M||N), because h(M||N)=f(M,N). So, some form of finalisation function has to be used to break this relationship.
你可能会注意到，这个图表有一个我描述中没有的额外阶段：“最终确定”阶段。这是为了防止长度扩展攻击。例如，如果 N 是单个块（即 N∈{0,1}r ），如果攻击者知道 h(M)=x ，那么他可以非常容易地计算 h(M||N) ，因为#4。因此，必须使用某种形式的最终确定函数来打破这种关系。