Hashing Applications

Page #44333 of Chapter:

You may view in full screen, if you like
.

level indicator

****

The speed of the hashing, the small size of the hash, and the equivocation that protects messages from being recreated, together suggest a host of applications, generally regarding securing the identities of messages, and verifying the identity of their writers. For example:

  • Securing a bilateral message
  • Securing a chain message
  • Trusted Third Party Applications
  • Secure password files

    Securing a Bilateral Message:

    Alice sending message M to Bob, also sends to Bob, H = h(M), the hash of M. Bob, upon receipt of Alice message, read as M', computes its hash: H'=h(M). If H=H' Bob concludes that M'=M because the used hashing algorithm satisfies the hashing requirements.

    If Alice sends H along with M with no further encryption, then a hacker can replace them both with M', and H' that are different from M and H respectively, but Bob will not be the wiser because his hash, H" will be equal to H"=H'.

    To prevent an assailant from changing M and H, Alice might (i) send H through a different channel, or (ii) encrypt H with her private key, to be decrypted by Bob through Alice's public key, or (iii) use a key-based hashing algorithm, where the key is known to Bob.

    Securing a Chain Message

    Alice wishes to send a message to Bob, who might add his comments, and send the package to Carla, who also may wish to add something before sending the entire piece of data to David, etc. This can be done by Alice appending M with its hash H, encrypted with her private key. Alice then sends the package to Bob. Bob, in turn, adds his comments and his identification data, then hashes the entire new package. He encrypts the hash with his private key, appends it to the package and sends to Carla, who does the same and sends the growing package to David, and so on. The hopping package includes the original message M plus a crypto proof of the fact that Bob, Carla, David, etc. have all seen M, and perhaps commented on it.

    Trusted Third Party Applications

    The Internet thrusts together strangers who need to collaborate quickly and perhaps not-repeatedly. Identity or bona-fide verification is too cumbersome, so a trusted third party may be used.

    Trusty enjoys a great deal of public trust, so Alice and Bob turn to Trusty to be checked for identity and for bona fide. If they pan out, they each receive a statement of bonafide, which is hashed, and the hash is being signed by Trusty's private key. Now Alice can prove her bonafide to Bob, by sending him the statement of her qualifications issued by Trusty. Bob has confidence that the statement, the certificate, was issued by Trusty because he verifies that it corresponds to the decrypted hash Alice sent forth along with the certificate contents. And vice versa.

    Secure Password File

    A server may keep clients passwords indirectly -- keeping only their hash, and comparing it to the rehashed password submitted by the client. a hacker compromising that file cannot regenerate from it the qualified password.

  • * Version CE-H6703 (SERVER) Crypto Academy