Principles for Designing Secure Block Ciphers and One-Way Hash Functions

This thesis is concerned with issues of designing secure (secret-key) block ciphers and constructing one-way hash functions. Both block ciphers and one-way hash functions are indispensable to secure information systems built on cryptographic techniques. With a block cipher, we can safeguard our important information transmitted over insecure communication networks. And with a one-way hash function, we can safely compress very long messages into relatively short ones to improve the overall e ciency of an information system or to detect un-authorized modi cations to these messages. The thesis consists of two parts. Part I deals with designing secure block ciphers and Part II with constructing one-way hash functions. The outlines of the two parts are as follows. In Part I, we rst prove an impossibility result on constructing pseudo-random permutations from random functions, which is closely related to the design of secure block ciphers. Then we consider the problem of constructing block ciphers which have the following ideal properties: 1. The ciphers are provably secure, 2. Security of the ciphers does not depend on any unproved hypotheses, 3. The ciphers can be easily implemented with current technology, and 4. All design criteria for the ciphers are made public. It is currently unclear whether or not there really exists such an ideal block cipher. So to meet the requirements of practical applications, the best thing we can do is to construct a block cipher such that it approximates the ideal one as closely as possible. In this thesis, we make a signi cant step in this direction. In particular, we construct several block ciphers which have the above mentioned properties 2, 3 and 4 as well as the following one: 10. Security of the ciphers is supported by convincing evidence. viii In Part II, we rst reveal a duality between constructions of two basic cryptographic primitives, pseudo-random string generators and one-way hash functions . Applying the duality, we present a construction for universal one-way hash functions assuming the existence of one-way permutations. Using ideas behind the construction, we propose practical one-way hash functions, the fastest of which compress nearly 2n-bit long input into n-bit long output strings by applying only twice a one-way function. Then we prove that universal one-way hash functions with respect to initial-strings chosen arbitrarily exist if and only if universal one-way hash functions with respect to initial-strings chosen uniformly at random exist. As an application of the result, we show that universal one-way hash functions with respect to initial-strings chosen arbitrarily can be constructed under the assumption of the existence of one-way quasiinjections. Finally, we investigate relationships among various versions of one-way hash functions. We prove that some versions of one-way hash functions are strictly included in others by explicitly constructing hash functions that are one-way in the sense of the former but not in the sense of the latter. Most of the results contained in this thesis were announced at EuroCrypt'89 [ZMI89a], Crypto'89 [ZMI89b], AAECC-8 [ZMI90a], SCIS90 [ZMI90b], and Crypto'90 [ZMI90c].