User:Carlaobatista

Ataque de Aniversário

A '''birthday attack''' is a type of [[cryptography|cryptographic]] [[cryptanalysis|attack]] that exploits the [[mathematics]] behind the [[birthday problem]] in [[probability theory]]. This attack can be used to abuse communication between two or more parties. The attack depends on the higher likelihood of [[collision (computer science)|collision]]s found between random attack attempts and a fixed degree of permutations ([[pigeonhole principle|pigeonhole]]s).

Understanding the problem

{{Main|Birthday problem}}

As an example, consider the scenario in which a teacher with a class of 30 students asks for everybody's birthday, to determine whether any two students have the same birthday (corresponding to a [[collision (computer science)|hash collision]] as described further [for simplicity, ignore February 29]). Intuitively, this chance may seem small. If the teacher picked a specific day (say September 16), then the chance that at least one student was born on that specific day is <math>1 - (364/365)^{30}</math>, about 7.9%. However, the probability that at least one student has the same birthday as ''any'' other student is around 70% for n = 30, from the formula <math>1-365!/((365-n)!\cdot 365^n)</math>.<ref>{{cite web|title=Math Forum: Ask Dr. Math FAQ: The Birthday Problem|url=http://mathforum.org/dr.math/faq/faq.birthdayprob.html}}</ref>

Mathematics

Given a function <math>f</math>, the goal of the attack is to find two different inputs <math>x_{1}, x_{2}</math> such that <math>f(x_{1}) = f(x_{2})</math>. Such a pair <math>x_{1}, x_{2}</math> is called a [[Collision (computer science)|collision]]. The method used to find a collision is simply to evaluate the function <math>f</math> for different input values that may be chosen randomly or pseudorandomly until the same result is found more than once. Because of the birthday problem, this method can be rather efficient. Specifically, if a [[function (mathematics)|function]] <math>f(x)</math> yields any of <math>H</math> different outputs with equal probability and <math>H</math> is sufficiently large, then we expect to obtain a pair of different arguments <math>x_{1}</math> and <math>x_{2}</math> with <math>f(x_{1}) = f(x_{2})</math> after evaluating the function for about <math>1.25\sqrt{H}</math> different arguments on average.

We consider the following experiment. From a set of ''H'' values we choose ''n'' values uniformly at random thereby allowing repetitions.  Let ''p''(''n''; ''H'') be the probability that during this experiment at least one value is chosen more than once. This probability can be approximated as

: <math> p(n;H) \approx 1 - e^{-n(n-1)/(2H)} \approx 1-e^{-n^2/(2H)}, \,</math>

Let ''n''(''p''; ''H'') be the smallest number of values we have to choose, such that the probability for finding a collision is at least ''p''.  By inverting this expression above, we find the following approximation

<math>n(p;H)\approx \sqrt{2H\ln\frac{1}{1-p}},</math>

and assigning a 0.5 probability of collision we arrive at

: <math>n(0.5;H) \approx 1.1774 \sqrt H. \,</math>

Let ''Q''(''H'') be the expected number of values we have to choose before finding the first collision. This number can be approximated by

: <math>Q(H)\approx \sqrt{\frac{\pi}{2}H}.</math>

As an example, if a 64-bit hash is used, there are approximately 1.8 × 10¹⁹ different outputs. If these are all equally probable (the best case), then it would take 'only' approximately 5 billion attempts (5.1 × 10⁹) to generate a collision using brute force. This value is called '''birthday bound'''<ref>See [[upper and lower bounds]].</ref> and for ''n''-bit codes it could be computed as 2^''n''/2.<ref>{{Cite journal   | author = Jacques Patarin, Audrey Montreuil   | title = Benes and Butterfly schemes revisited   | version =   | publisher = Université de Versailles   | year = 2005   | url = http://eprint.iacr.org/2005/004   | format = [[PostScript]], [[PDF]]   | accessdate = 2007-03-15 }} </ref> Other examples are as follows: :{| class="wikitable" style="white-space:nowrap;" |- ! rowspan="2"  style="background:lightgrey;" | Bits ! rowspan="2"  style="background:lightgrey;" | Possible outputs<br>(2 [[significant figures|s.f.]]) (H) ! colspan="10" style="background:lightgrey;" | Desired probability of random collision<br>(2 s.f.) (p) |- ! style="background:lightgrey;" | 10⁻¹⁸ ! style="background:lightgrey;" | 10⁻¹⁵ ! style="background:lightgrey;" | 10⁻¹² ! style="background:lightgrey;" | 10⁻⁹ ! style="background:lightgrey;" | 10⁻⁶ ! style="background:lightgrey;" | 0.1% ! style="background:lightgrey;" | 1% ! style="background:lightgrey;" | 25% ! style="background:lightgrey;" | 50% ! style="background:lightgrey;" | 75% |- align="center" | bgcolor="lightgrey" | 16 | bgcolor="lightgrey" | 65,536</sup> | <2 | <2 | <2 | <2 | <2 | 11 | 36 | 190 | 300 | 430 |- align="center" | bgcolor="lightgrey" | 32 | bgcolor="lightgrey" | 4.3 × 10⁹ | <2 | <2 | <2 | 3 | 93 | 2900 | 9300 | 50,000 | 77,000 | 110,000 |- align="center" | bgcolor="lightgrey" | 64 | bgcolor="lightgrey" | 1.8 × 10¹⁹ | 6 | 190 | 6100 | 190,000 | 6,100,000 | 1.9 × 10⁸ | 6.1 × 10⁸ | 3.3 × 10⁹ | 5.1 × 10⁹ | 7.2 × 10⁹ |- align="center" | bgcolor="lightgrey" | 128 | bgcolor="lightgrey" | 3.4 × 10³⁸ | 2.6 × 10¹⁰ | 8.2 × 10¹¹ | 2.6 × 10¹³ | 8.2 × 10¹⁴ | 2.6 × 10¹⁶ | 8.3 × 10¹⁷ | 2.6 × 10¹⁸ | 1.4 × 10¹⁹ | 2.2 × 10¹⁹ | 3.1 × 10¹⁹ |- align="center" | bgcolor="lightgrey" | 256 | bgcolor="lightgrey" | 1.2 × 10⁷⁷ | 4.8 × 10²⁹ | 1.5 × 10³¹ | 4.8 × 10³² | 1.5 × 10³⁴ | 4.8 × 10³⁵ | 1.5 × 10³⁷ | 4.8 × 10³⁷ | 2.6 × 10³⁸ | 4.0 × 10³⁸ | 5.7 × 10³⁸ |- align="center" | bgcolor="lightgrey" | 384 | bgcolor="lightgrey" | 3.9 × 10¹¹⁵ | 8.9 × 10⁴⁸ | 2.8 × 10⁵⁰ | 8.9 × 10⁵¹ | 2.8 × 10⁵³ | 8.9 × 10⁵⁴ | 2.8 × 10⁵⁶ | 8.9 × 10⁵⁶ | 4.8 × 10⁵⁷ | 7.4 × 10⁵⁷ | 1.0 × 10⁵⁸ |- align="center" | bgcolor="lightgrey" | 512 | bgcolor="lightgrey" | 1.3 × 10¹⁵⁴ | 1.6 × 10⁶⁸ | 5.2 × 10⁶⁹ | 1.6 × 10⁷¹ | 5.2 × 10⁷² | 1.6 × 10⁷⁴ | 5.2 × 10⁷⁵ | 1.6 × 10⁷⁶ | 8.8 × 10⁷⁶ | 1.4 × 10⁷⁷ | 1.9 × 10⁷⁷ |} :''Table shows number of hashes n''(''p'')'' needed to achieve the given probability of success, assuming all hashes are equally likely. For comparison, ''10⁻¹⁸'' to ''10⁻¹⁵'' is the uncorrectable bit error rate of a typical hard disk [http://arxiv.org/abs/cs/0701166]. In theory, [[MD5]] hashes or [[Universally unique identifier|UUIDs]], being 128 bits, should stay within that range until about 820 billion documents, even if its possible outputs are many more.''

It is easy to see that if the outputs of the function are distributed unevenly, then a collision could be found even faster.  The notion of 'balance' of a hash function quantifies the resistance of the function to birthday attacks (exploiting uneven key distribution) and allows the vulnerability of popular hashes such as MD and SHA to be estimated ([http://citeseer.ist.psu.edu/bellare02hash.html Bellare and Kohno, 2004]).

The subexpression <math>\ln\frac{1}{1-p}</math> in the equation for <math>n(p;H)</math> is not computed accurately for small <math>p</math> when directly translated into common programming languages as <code>log(1/(1-p))</code> due to [[loss of significance]].  When <code>log1p</code> is available (as it is in [[C99]]) for example, the equivalent expression <code>-log1p(-p)</code> should be used instead.<ref>{{cite web|title=Compute log(1+x) accurately for small values of x|url=http://www.mathworks.com/help/techdoc/ref/log1p.html}}</ref>  If this is not done, the first column of the above table is computed as zero, and several items in the second column do not have even one correct significant digit.

Source code example

Here is a [[Python (programming language)|Python]] function that can accurately generate most of the above table: <syntaxhighlight lang="python"> def birthday(probability_exponent, bits):     from math import log1p, sqrt     probability = 10. ** probability_exponent     outputs     =  2. ** bits     return sqrt(2. * outputs * -log1p(-probability)) </syntaxhighlight> If the code is saved in a file named <code>birthday.py</code>, it can be run interactively as in the following example: <source lang="bash"> $ python -i birthday.py >>> birthday(-15, 128) 824963474247.1193 >>> birthday(-6, 32) 92.68192319417072 </source>

Simple approximation

A good [[rule of thumb]] which can be used for [[mental calculation]] is the relation

:<math>p(n) \approx {n^2 \over 2m}</math>

which can also be written as

:<math>n \approx \sqrt { 2m \times p(n)}</math>.

This works well for probabilities less than or equal to 0.5.

This approximation scheme is especially easy to use for when working with exponents. For instance, suppose you are building 32-bit hashes (<math> m = 2^{32}</math>) and want the chance of a collision to be at most one in a million (<math> p \approx 2^{-20} </math>), how many documents could we have at the most?

<math>n \approx \sqrt { 2 \times 2^{32} \times 2^{-20}} = \sqrt { 2^{1+32-20} } = \sqrt { 2^{13} } = 2^{6.5} \approx 90.5 </math>

which is close to the correct answer of 93.

Digital signature susceptibility

[[Digital signature]]s can be susceptible to a birthday attack. A message <math>m</math> is typically signed by first computing <math>f(m)</math>, where <math>f</math> is a [[cryptographic hash function]], and then using some secret key to sign <math>f(m)</math>. Suppose [[Alice and Bob|Mallory wants to trick Bob]] into signing a [[fraudulent]] contract. Mallory prepares a fair contract <math>m</math> and a fraudulent one <math>m'</math>. She then finds a number of positions where <math>m</math> can be changed without changing the meaning, such as inserting commas, empty lines, one versus two spaces after a sentence, replacing synonyms, etc. By combining these changes, she can create a huge number of variations on <math>m</math> which are all fair contracts.

In a similar manner, Mallory also creates a huge number of variations on the fraudulent contract <math>m'</math>. She then applies the hash function to all these variations until she finds a version of the fair contract and a version of the fraudulent contract which have the same hash value, <math>f(m) = f(m')</math>. She presents the fair version to Bob for signing. After Bob has signed, Mallory takes the signature and attaches it to the fraudulent contract. This signature then "proves" that Bob signed the fraudulent contract.

The probabilities differ slightly from the original birthday problem, as Mallory gains nothing by finding two fair or two fraudulent contracts with the same hash. Mallory's strategy is to generate pairs of one fair and one fraudulent contract. The birthday problem equations apply where <math>n</math> is the number of pairs. The number of hashes Mallory actually generates is <math>2n</math>.

To avoid this attack, the output length of the hash function used for a signature scheme can be chosen large enough so that the birthday attack becomes computationally infeasible, i.e. about twice as many bits as are needed to prevent an ordinary [[brute-force attack]].

[[Pollard's rho algorithm for logarithms]] is an example for an algorithm using a birthday attack for the computation of [[discrete logarithm]]s.

See also

* [[Collision attack]] * [[Meet-in-the-middle attack]]

Notes

{{reflist}}

References

{{refbegin}} * [[Mihir Bellare]], Tadayoshi Kohno: Hash Function Balance and Its Impact on Birthday Attacks. [[EUROCRYPT]] 2004: pp401–418 * ''Applied Cryptography, 2nd ed.'' by [[Bruce Schneier]] {{refend}}

External links

* [http://www.rsasecurity.com/rsalabs/node.asp?id=2182 "What is a digital signature and what is authentication?"] from [[RSA (security firm)|RSA Security]]'s crypto [[FAQ]]. * [http://x5.net/faqs/crypto/q95.html "Birthday Attack"] X5 Networks Crypto FAQs

{{cryptography navbox | hash}}

{{DEFAULTSORT:Birthday Attack}} [[Category:Cryptographic attacks]]

[[de:Kollisionsangriff#Geburtstagsangriff]]