# Constructing Keyed Hash Algorithm Using Enhanced Chaotic Map with Varying Parameter

Authors: Hongjun Liu; Abdurahman Kadir; Chao Ma; Chengbo Xu
Journal: Mathematical Problems in Engineering
 (2020)

---

## Abstract

A keyed hash algorithm is proposed based on 1-D enhanced quadratic map (EQM) with varying parameter. Three measures, including assigning unique one-time keys, key expansion, and hash length extension, are taken to enhance its security. First, the message is transformed into a parameter sequence for the EQM to be absorbed, and then the extended keys are generated as the initial values of the EQM. Finally, the EQM is iterated with redundant loops to transform the variable values into a hash value. The algorithm is so flexible that it can generate hash value with different lengths of 256, 512, 1024, or more bits through a parameter switcher, and redundant loops can eliminate the transient effect of chaos and mitigate the increasing threat of the side-channel attack. Security evaluations and comparison demonstrated its practicability and reliability.


---

## Body

## 1. Introduction

Hash algorithm is widely used for assuring data integrity in cryptography [1]; it can map a message with arbitrary length to a hash value with fixed length. If the input message is unknown, it is extremely difficult to reconstruct via its hash value. In theoretical cryptography, the security level of a hash algorithm could be defined by three properties [2]: preimage resistance, second preimage resistance, and collision resistance. None of the existing hash algorithms is secure absolutely. Even if a hash algorithm has not been broken up to now, a successful attack against a weakened variant may result in its abandonment, such as the theoretical weaknesses of SHA-1 were found in 2005 [3], a successful attack on MD5 in 2008 [4], and Google announced a collision in SHA-1 in 2017 [5]. Although some recognized hash algorithms, such as SHA-2, SHA-3, and SM3, are still secure up to now, however, all kinds of attacks on them are going on and on [6].Many hash algorithms based on chaotic maps have been proposed [7]; however, some 1-D chaotic maps, such as logistic map and tent map, are typically insecure or slow, and most of these hash algorithms have been broken successfully. Xiao et al. [8] constructed a hash algorithm based on the piecewise linear chaotic map with changeable parameter; however, Guo et al. [9] analyzed its weakness and utilized weak keys to construct a collision successfully. Kwok and Tang [10] designed a hash algorithm based on a high-dimension chaotic map, and a compression function was developed according to the diffusion and confusion properties of the chaotic map; however, Deng et al. [11] analyzed the potential flaws in this hash algorithm and took corresponding measures to enhance the influence of a single-bit change in the message on the changes in the final hash value. Liu et al. [12] proposed a keyed hash function using a hyperchaotic system with time-varying parameter perturbation, which is flexible and has a larger key space. Teh et al. [13] designed a keyed hash function based on the logistic map with fixed point representation. Li et al. designed four 128-bit parallel hash functions based on cross-coupled map lattices [14], tent map [15], circular shifts [16], and dynamic S-box [17] with varying parameters.An attacker can crack the hash value of a short password using a precomputed rainbow table [18]. Petr et al. [19] designed a secure and efficient hash function with extra padding against rainbow table attacks to block rainbow table attacks by adding additional identification information to extend the key length.Herein, we design a novel keyed hash algorithm and take three measures to resist some known attacks. We use a preencoding process to obtain the Unicode of each character in the message, transform it into a parameter sequence for the EQM to absorb, output the extended keys to serve as initial values, and use the generation process to generate a hash value with flexible length by the EQM. Redundant iterations are deliberately designed, which can both eliminate the transient effect of the chaotic map and mitigate the increasing threat of the side-channel attack. Performance evaluation demonstrated the effectiveness and flexibility of the proposed hash algorithm.The remainder of the paper is organized as follows: Section2 briefly introduces the EQM. Section 3 presents the hash algorithm. In Section 4, we present the experimental evaluation, and in Section 5, we present our conclusion.


## 2. The EQM

The classical quadratic map can be expressed using equation (1) [20]:(1)xi+1=γ−xi2,where the control parameter γ∈0,2 and state variable x∈−2,2. The bifurcation diagram, phase diagram, and Lyapunov exponent shown in Figure 1 demonstrate that equation (1) has abundant bifurcations and dense windows; hence, the distribution of state points is not uniform, and its randomness is not good.Figure 1
Bifurcation diagram, phase diagram, and Lyapunov exponent of equation (1).
(a)(b)(c)Based on equation (1), we constructed a 1-D EQM using equation (2):(2)xi+1=sinγ−2kγ−xi22,where the range of control parameter γ is extended to 0,18 and the exponent k∈7,1000. The bifurcation diagram and the phase diagram shown in Figures 2(a) and 2(b) demonstrate that the EQM has ergodicity and better randomness, and it is surjective within the interval x∈−1,1. Figure 2(c) demonstrates that the Lyapunov exponent increases gradually with the increase of γ∈0,18 [21]; hence, the map achieves chaotic state. The state variable x and exponent k can serve as keys.Figure 2
Bifurcation diagram, phase diagram, and Lyapunov exponent of equation (2).
(a)(b)(c)


## 3. Hash Algorithm

Input: messageM with n characters, which can be single-byte or multibyte, and theoretically, the length of the message can be infinite. A unique one-time 256-bit key is assigned according to each user’s identification.Output: hash valueH with len-bit.A hash algorithmH (M, len, key) can be described as follows:Step 1 (message pre-encoding): for each charactermi∈M, i=1,2,…,n, transform it into a corresponding Unicode value using equation (3) to obtain ri and serve as varying parameter γ of equation (2). It should be noted that even if M is a null string, we can pad four specific characters of “====” to it.(3)ri=unicodemi2×10−4,if unicodemi<1000,unicodemi×2×10−4,if unicodemi≥1000.Step 2 (key derivation): transform a 256-bit key into its hexadecimal numberK=k1,k2,…,k64, and then generate four initial values x01,1, x02,1, x03,1, and x04,1 using equation (4) and exponent sequence S=s1,s2,…,s16 as salt using equation (5):(4)x01,1=∑i=116ki×10−4,x02,1=∑i=1732ki×10−4,x03,1=∑i=3348ki×10−4,x04,1=∑i=4964ki×10−4,(5)s1=∑i=14ki,s2=∑i=58ki,…,s16=∑i=6164ki.Step 3 (message absorption): iterate equation (2) 16 rounds with initial parameter sequence ri, exponent k=s1, and initial value x01,1, from the second round, set ri=x11,i, and so on. Similarly, iterate equation (2) with ri and initial values x02,1, x03,1, and x04,1, respectively. Finally, we can obtain four variable values xr1,n, xr2,n, xr3,n, and xr4,n to serve as new initial values of equation (2) with exponent k=s2.Step 4 (hash value generation): after iterating equation (2) 300 times to eliminate the transient process, continue to iterate it len/16 times using four initial values xr1,n, xr2,n, xr3,n, and xr4,n with the salt sequence k∈s1,s2,…,s16 as salt in turn to obtain four variable sequences xTSj, yTSj, zTSj, and uTSj, j∈1,len/16. Transform them into unsigned integers within the interval [0, 255] using equation (6) to generate two groups of hash value H1 and H2 in hexadecimal form using equation (7), and concatenate them to obtain the final hash value H=H1||H2:(6)Xh=uint8modxTS1:len16×1014,256,Yh=uint8modyTS1:len16×1014,256,Zh=uint8modzTS1:len16×1014,256,Uh=uint8moduTS1:len16×1014,256,(7)H1=dec2hexbitxorXh,Yh,H2=dec2hexbitxorZh,Uh.The flowchart of the proposed hash algorithm is shown in Figure3.Figure 3
Flowchart of the hash algorithm.


## 4. Experimental Evaluation

### 4.1. Key Space

The proposed hash algorithm has a one-time 256-bit external keyK; hence, the key space S=2256 [22], which is large enough to resist the brute-force attack [23].


### 4.2. Hash Sensitivity to Message and Keys

A good hash algorithm based on the chaotic map, should be very sensitive to any small change of the input message and initial conditions [12]. In the following tests, M1 represents the original input message, M2, M3, and M4 represent minor modifications to M1, and M5 represents a minor change to K.The original messageM1: “as of 2018, the development of actual quantum computers is still in its infancy, but experiments have been carried out in which quantum computational operations were executed on a very small number of quantum bits. Both practical and theoretical research continue, and many national governments and military agencies are funding quantum computing research in additional effort to develop quantum computers for civilian, business, trade, and environmental and national security purposes, such as cryptanalysis. A small 16-qubit quantum computer exists and is available for experiments via the IBM quantum experience project.”M2: replace the first character “A” of M1 with “a.”M3: replace the last character “.” of M1 with “,”.M4: add a blank space to the end of M1.M5: change one bit to K.The 256-, 512-, and 1024-bit hash values in hexadecimal form are given in Table1, and the results of Hamming distance demonstrate that any slight modifications on messages or key will lead to about 50% difference in the hash value.Table 1
The corresponding hash value under different conditions and Hamming distance.
MessageHash value in hexadecimal formatHamming distanceH12563EE44E85E8C91969B0ADF5A722A717B21E0905D5109537F6221D725A633371280H225631144FF9DFD5CE79D88BA243D9686A63E2AE878AD6CEDCCA2C19060DAAA24C62133H32560FD77424F0640281DA91ACB2836416D382A0CCD15522D9B876B75A15CC68E60D120H4256FA4B99531FD9978E0B40AF6B800F0592F2FDF06EF6EA65EAD690E4861B72E6C6142H5256FCACEDF832033220D6D3FB589966278D644F7548EDE9F3C2192D457DBC99E115137H151228EB279A3633EB07A253B2C1F1ABDD111903DEA29F667B62A39D234434EE09D4D4262D645150C62CDC687D9802B13CFB20CFE079CF01A1CD7DC811CB58D1A0BB0H2512EF6634EABC0BCD0371A69EE1A9E03F36E21A6D28A60A934B393C76A66CF89C1EBA1659024A2ED832B8053C8E41F4FD27478B0865E3CEC131DC56998F2EA9BBAD236H35120A381CC165B44A49F21DD867FAD14CEADBCB81EECF92AC9117E73AE9A903D86C90076B68AD0AD9AA6CE61612A3EC6B517A6F3E3DE3B4FE4B23F85846212C0ED8259H4512CE146D559E4705C31DDCC5948A0F8D0485599C3BC6D6A1CD6F10AFDF09387E9961EFE55A49A5E5A2A6B0B772339776B0445D27DEE4C3F7EF5E85F9DEA81BDA13264H551213D4A9E9D793F8F2722623480F2621AF8432F46028D222032BFD10C3E4BB1F9A22D61FD6208E871ACFFC9DC42C503EDD8BD1A5BE27E9611AA282FE303D1BD71B260H11024D9D5507D603DD2D341CDB1640BCEC032365A30AE9EF14CE348FBDB351C51A146BFB137EB8AD9763CE8E938D1BA6591BE4D78CE19E8DF5BF35AE3B75D207A07F8352B88E824D1B013A5094FE3CBAE39C4A211BCA1A0CD957AED7918CC55CBB35E0F4D4F69A27F5CA1657A5CF6B960908AF4861199C868C6013F437616EF9160100H2102419410779749888635E7934935B3D0342BD7A7C2269D572414F8B6781F571C074E6FE4261BD9712FE255422ACA52CD1D2D64DAE420AC1257EFA24EBDEFA12374CDFB904C9B51B36D3853BEF658050C6F48EDE783EF1869CA33816E639459AF958372E7F7D3662CD9B89F890B17FEC2AFA6F8B4C89FDE9AF3E79FA7D8D86BDF779477H31024ED2F304D1B9A0003E9811930DA7E1224DE7AAE268E18AC0FE801A47202DB6B7833C6930C4DB478B2EA3D946A5ADB916F440EA8F9FF93C8507D8E4D5CD87C3E49BFFB4C8F5D66376F326EA140F58442D9CDFDBEC1D18E39033C90870F26F214528D8410BD7573076FCE4B1B447866C83832663A684DBA3D6FF15C460F750B419C503H4102485D92E2E37F5E76A224B8F8228E6085CAEEBF1EC2E719DA30817E00AB30505675AC9A1EF6482002EF0BDDA466D0F1BA9953D927C35BB07C4AA6BF1832881933B11CEADB001FB644344583ED1CED4C025EE622A0EC4F520CABE5197569006F3432B63EA783F2CB15BDE5AC25E76FAD294814EBF1572661B8349C20DEB3BC27197488H5102480AC152E93D2AFD97284048BB3A46337508AC8E795F133B1DC8F65E0D04C33D48FC2EE4B5AC7531DD3EE3E934C7249041A325A44CDC9DCC6B1B59A715D6FE4AE5727191A8ED83BFCAFB6DCE46C57AC329E5D84D2DA1CD1571B1C6D58DBC10929CB9437224EC2C1B92C1CC2FD00D039A684DDD00235F69A579183AA05E84E1314515


### 4.3. Statistical Distribution of Hash Value

The hash value generated by a good hash algorithm should be evenly distributed. Here, we use Figure4 to show the distributions of the message M1 and hash values of H1256 and H1512; from Figure 4(a), we can find that the ASCII values of M1 are localized within some specified intervals, while the hash values shown in Figures 4(b) and 4(c) distribute uniformly. In addition, we utilize the hash algorithm to calculate the 256-, 512-, and 1024-bit hash values of a null string; from Figure 5, we can infer that the distributions of hash values are also uniform.Figure 4
Distribution ofM1 and its 256- and 512-bit hash values.
(a)(b)(c)Figure 5
Distribution of 256-, 512-, and 1024-bit hash values of a null string.
(a)(b)(c)


### 4.4. Statistical Analysis of Confusion and Diffusion

The hash value of a good hash algorithm should be confused and diffused completely [12], and the ideal result is that one-bit change to the input bits would lead to 50% change in the output bits. Here, we conducted a large number of experiments to analyze its performance. First, a random message M with the size of L=len×50 is generated, and len-bit hash value is calculated. Second, a single bit in M is changed, and a new len-bit hash value is calculated. Two hash values are compared bit by bit to obtain the total number of changed bits. The experiment is repeated N = 5000 times with len = 256-bit, 512-bit, and 1024-bit, respectively.The corresponding histogram distribution of the total number of different bits is plotted in Figure6, which demonstrates that the total numbers of changed bits concentrate around the ideal number 128-bit, 256-bit, and 512-bit, i.e., about 50% bits are changed; hence, the results of diffusion and confusion are ideal.Figure 6
Distribution of the total number of different bits. (a) 256-bit hash value. (b) 512-bit hash value. (c) 1024-bit hash value.
(a)(b)(c)The following statistics are used to test the performance of the hash algorithm. Here, len is the length of the hash value,N is the number of tests, Bi denotes the number of different bits between the hash values obtained in the i-th test, Bmin denotes the minimum number of different bits, Bmax denotes the maximum number of different bits, B¯ denotes the mean changed bit number, P denotes the mean changed probability, ΔB denotes the standard deviation of numbers of changed bits, and ΔP denotes the standard deviation [13].Tables2–4 are statistical results obtained by changing one bit to M1 randomly and executing the hash algorithm N times to obtain hash values with different hash lengths of 256-, 512-, and 1024-bit. Every time, the total number of changed bits between the new and the original hash values is calculated.Table 2
Statistical result for a 256-bit hash value.
N = 256N = 512N = 1024N = 2048N = 4096Bmin10799999999Bmax145150150152153B¯128.87128.32128.29128.15128.05P%50.3450.1250.1150.0650.02ΔB7.597.957.817.807.86ΔP%2.963.113.053.053.07Table 3
Statistical results for a 512-bit hash value.
N = 256N = 512N = 1024N = 2048N = 4096Bmin229222220220220Bmax289293293299299B¯257.21257.26256.47256.08255.99P%50.2350.2450.0950.0149.99ΔB11.3311.5611.4811.4211.30ΔP%2.212.262.242.232.21Table 4
Statistical results for a 1024-bit hash value.
N = 256N = 512N = 1024N = 2048N = 4096Bmin470469462456451Bmax549555562562567B¯511.33511.03511.41511.70512.20P%49.9349.9049.9449.9750.02ΔB15.8415.5215.9416.1616.11ΔP%1.551.511.561.581.57Tables5–7 are the comparison results with other hash algorithms, and the results demonstrate that, for all the values belonging to N, the mean changed bit number B¯ is very close to the ideal number of changed bits len/2, from which we can infer that the hash algorithm has strong capability of confusion and diffusion. Meanwhile, the mean changed probability P is very close to the ideal value of 50%, which is one of the desired features of confusion. Another good feature of the hash algorithm is that both ΔP and ΔB are very small for all the tests, which means that the confusion and diffusion capability is very stable.Table 5
Comparison with other algorithms for 256-bit hash value andN = 2048.
Hash algorithmBminBmaxB¯P%ΔBΔP%SHA2-256100155127.9850.008.103.16SHA3-256 [24]100154127.9649.988.043.14[6]101168128.0850.038.123.21[22]103155128.8149.938.133.18[23]102161128.0050.008.023.13Our hash algorithm (256-bit)99152128.1550.067.803.05Table 6
Comparison with other algorithms for 512-bit hash value andN = 2048.
Hash algorithmBminBmaxB¯P%ΔBΔP%SHA2-512215292256.2750.0511.512.25SHA3-512216287254.7549.7611.322.21[22]219296255.8949.9811.272.20[23]223296256.1050.0211.122.17Our hash algorithm (512-bit)220294255.6949.9411.452.24Table 7
Comparison with other algorithms for 1024-bit hash value andN = 2048.
Hash algorithmBminBmaxB¯P%ΔBΔP%[22]450565511.8949.9916.081.57[23]461572512.0650.0015.961.55Our hash algorithm (1024-bit)450562511.7249.9715.901.55


### 4.5. Collision Analysis

#### 4.5.1. Meet-in-the-Middle Attack

To seek a collision, the meet-in-the-middle attack is conducted on intermediate variables, and a collision could be found if two intermediate variables match [22, 23]. This type of attack is invalid for the proposed hash algorithm, due to the initial values of EQM serving as keys, which can make the inverse computation extremely difficult. Hence, the proposed hash algorithm can resist the meet-in-the-middle attack.


#### 4.5.2. Collision Analysis

To perform a collision analysis, messageM1 with the length of L = 50 len is randomly generated, and its len-bit hash values are calculated and stored in ASCII form (8-bit per character). Then, we randomly change one bit to M1, calculate its hash value, and compare two hash values to obtain the absolute difference d between two hash values using the following equation [12]:(8)d=∑i=1len/8decei−decei′,where ei and ei′ denote the i-th ASCII character of two hash values and the function dec maps an ASCII character to its decimal value. The theoretical value of average absolute distance per character is 85.3333.In Table8, we present the minimum, maximum, and mean values of the absolute difference between two hash values, from which we can infer that when we set h = 256 and 512, the results of the proposed hash algorithm are as good as some existing hash algorithms, such as SHA-2, SHA-3, and other chaos-based hash algorithms.Table 8
Absolute difference for hash values forN = 10,000.
Absolute differenceMaximumdMinimumdMeandMeand per character256-bit [22]4,1181,7582,87889.938256-bit [23]4,1381,6862,73285.375SHA2-2563,7571,7862,77686.746SHA3-25635251,8252,74185.675Our hash algorithm (256-bit)3,9311,5732,75486.081512-bit [22]7,3693,9585,47685.563512-bit [23]7,2103,9715,46385.359SHA2-5127,1323,8405,43084.852SHA3-5126,4815,6785,61287.684Our hash algorithm (512-bit)7,0364,5325,64287.293Our hash algorithm (1024-bit)13,0418,43910,78184.226


### 4.6. Rainbow Table Resistance Analysis

Rainbow table is a practical example of space/time tradeoff; it uses more computer processing time at the cost of less storage when calculating a hash value on every attempt or less processing time and more storage when comparing to a simple lookup table with one entry per hash. Use of a key derivation function that employs a salt makes this attack ineffective [19]. In the proposed hash algorithm, we took two measures to make the rainbow table attack ineffective. (1) One-time keys: we assign different one-time keys by the key sequence sampled from noise to different users according to their identifications. (2) Random salt: as for equation (2), we add salt derived from the key in each iteration through perturbing the exponent k to make the rainbow table attack ineffective.


### 4.7. Speed Analysis

In order to analyze the computation speed, we implemented the proposed hash algorithm on a PC with 2.50 GHz Intel Core i7-6500U, 16G Memory and Windows 10 operation system, and the tested message consists of 20,000 ASCII characters; the speed is about 131.2 Mbps withN = 2048. Experiments showed that the running speed is unaffected by the hash value length.


### 4.8. Computational Complexity

The computational complexity [16] of the proposed hash algorithm depends on the message length and iterations of the EQM. For any message M with the character length n, there are n times to transform it into a parameter sequence, and the time complexity is O(n). For the EQM, there are n + 300 + len/16 iterations with varying parameter; hence, the time complexity is O(n). There are 140 times of addition, multiplication, and modular, hex conversion, and XOR operations, which have nothing to do with n; hence, the corresponding time complexity is O(1). Therefore, the total computational complexity of the proposed hash algorithm is O (n).


## 4.1. Key Space

The proposed hash algorithm has a one-time 256-bit external keyK; hence, the key space S=2256 [22], which is large enough to resist the brute-force attack [23].


## 4.2. Hash Sensitivity to Message and Keys

A good hash algorithm based on the chaotic map, should be very sensitive to any small change of the input message and initial conditions [12]. In the following tests, M1 represents the original input message, M2, M3, and M4 represent minor modifications to M1, and M5 represents a minor change to K.The original messageM1: “as of 2018, the development of actual quantum computers is still in its infancy, but experiments have been carried out in which quantum computational operations were executed on a very small number of quantum bits. Both practical and theoretical research continue, and many national governments and military agencies are funding quantum computing research in additional effort to develop quantum computers for civilian, business, trade, and environmental and national security purposes, such as cryptanalysis. A small 16-qubit quantum computer exists and is available for experiments via the IBM quantum experience project.”M2: replace the first character “A” of M1 with “a.”M3: replace the last character “.” of M1 with “,”.M4: add a blank space to the end of M1.M5: change one bit to K.The 256-, 512-, and 1024-bit hash values in hexadecimal form are given in Table1, and the results of Hamming distance demonstrate that any slight modifications on messages or key will lead to about 50% difference in the hash value.Table 1
The corresponding hash value under different conditions and Hamming distance.
MessageHash value in hexadecimal formatHamming distanceH12563EE44E85E8C91969B0ADF5A722A717B21E0905D5109537F6221D725A633371280H225631144FF9DFD5CE79D88BA243D9686A63E2AE878AD6CEDCCA2C19060DAAA24C62133H32560FD77424F0640281DA91ACB2836416D382A0CCD15522D9B876B75A15CC68E60D120H4256FA4B99531FD9978E0B40AF6B800F0592F2FDF06EF6EA65EAD690E4861B72E6C6142H5256FCACEDF832033220D6D3FB589966278D644F7548EDE9F3C2192D457DBC99E115137H151228EB279A3633EB07A253B2C1F1ABDD111903DEA29F667B62A39D234434EE09D4D4262D645150C62CDC687D9802B13CFB20CFE079CF01A1CD7DC811CB58D1A0BB0H2512EF6634EABC0BCD0371A69EE1A9E03F36E21A6D28A60A934B393C76A66CF89C1EBA1659024A2ED832B8053C8E41F4FD27478B0865E3CEC131DC56998F2EA9BBAD236H35120A381CC165B44A49F21DD867FAD14CEADBCB81EECF92AC9117E73AE9A903D86C90076B68AD0AD9AA6CE61612A3EC6B517A6F3E3DE3B4FE4B23F85846212C0ED8259H4512CE146D559E4705C31DDCC5948A0F8D0485599C3BC6D6A1CD6F10AFDF09387E9961EFE55A49A5E5A2A6B0B772339776B0445D27DEE4C3F7EF5E85F9DEA81BDA13264H551213D4A9E9D793F8F2722623480F2621AF8432F46028D222032BFD10C3E4BB1F9A22D61FD6208E871ACFFC9DC42C503EDD8BD1A5BE27E9611AA282FE303D1BD71B260H11024D9D5507D603DD2D341CDB1640BCEC032365A30AE9EF14CE348FBDB351C51A146BFB137EB8AD9763CE8E938D1BA6591BE4D78CE19E8DF5BF35AE3B75D207A07F8352B88E824D1B013A5094FE3CBAE39C4A211BCA1A0CD957AED7918CC55CBB35E0F4D4F69A27F5CA1657A5CF6B960908AF4861199C868C6013F437616EF9160100H2102419410779749888635E7934935B3D0342BD7A7C2269D572414F8B6781F571C074E6FE4261BD9712FE255422ACA52CD1D2D64DAE420AC1257EFA24EBDEFA12374CDFB904C9B51B36D3853BEF658050C6F48EDE783EF1869CA33816E639459AF958372E7F7D3662CD9B89F890B17FEC2AFA6F8B4C89FDE9AF3E79FA7D8D86BDF779477H31024ED2F304D1B9A0003E9811930DA7E1224DE7AAE268E18AC0FE801A47202DB6B7833C6930C4DB478B2EA3D946A5ADB916F440EA8F9FF93C8507D8E4D5CD87C3E49BFFB4C8F5D66376F326EA140F58442D9CDFDBEC1D18E39033C90870F26F214528D8410BD7573076FCE4B1B447866C83832663A684DBA3D6FF15C460F750B419C503H4102485D92E2E37F5E76A224B8F8228E6085CAEEBF1EC2E719DA30817E00AB30505675AC9A1EF6482002EF0BDDA466D0F1BA9953D927C35BB07C4AA6BF1832881933B11CEADB001FB644344583ED1CED4C025EE622A0EC4F520CABE5197569006F3432B63EA783F2CB15BDE5AC25E76FAD294814EBF1572661B8349C20DEB3BC27197488H5102480AC152E93D2AFD97284048BB3A46337508AC8E795F133B1DC8F65E0D04C33D48FC2EE4B5AC7531DD3EE3E934C7249041A325A44CDC9DCC6B1B59A715D6FE4AE5727191A8ED83BFCAFB6DCE46C57AC329E5D84D2DA1CD1571B1C6D58DBC10929CB9437224EC2C1B92C1CC2FD00D039A684DDD00235F69A579183AA05E84E1314515


## 4.3. Statistical Distribution of Hash Value

The hash value generated by a good hash algorithm should be evenly distributed. Here, we use Figure4 to show the distributions of the message M1 and hash values of H1256 and H1512; from Figure 4(a), we can find that the ASCII values of M1 are localized within some specified intervals, while the hash values shown in Figures 4(b) and 4(c) distribute uniformly. In addition, we utilize the hash algorithm to calculate the 256-, 512-, and 1024-bit hash values of a null string; from Figure 5, we can infer that the distributions of hash values are also uniform.Figure 4
Distribution ofM1 and its 256- and 512-bit hash values.
(a)(b)(c)Figure 5
Distribution of 256-, 512-, and 1024-bit hash values of a null string.
(a)(b)(c)


## 4.4. Statistical Analysis of Confusion and Diffusion

The hash value of a good hash algorithm should be confused and diffused completely [12], and the ideal result is that one-bit change to the input bits would lead to 50% change in the output bits. Here, we conducted a large number of experiments to analyze its performance. First, a random message M with the size of L=len×50 is generated, and len-bit hash value is calculated. Second, a single bit in M is changed, and a new len-bit hash value is calculated. Two hash values are compared bit by bit to obtain the total number of changed bits. The experiment is repeated N = 5000 times with len = 256-bit, 512-bit, and 1024-bit, respectively.The corresponding histogram distribution of the total number of different bits is plotted in Figure6, which demonstrates that the total numbers of changed bits concentrate around the ideal number 128-bit, 256-bit, and 512-bit, i.e., about 50% bits are changed; hence, the results of diffusion and confusion are ideal.Figure 6
Distribution of the total number of different bits. (a) 256-bit hash value. (b) 512-bit hash value. (c) 1024-bit hash value.
(a)(b)(c)The following statistics are used to test the performance of the hash algorithm. Here, len is the length of the hash value,N is the number of tests, Bi denotes the number of different bits between the hash values obtained in the i-th test, Bmin denotes the minimum number of different bits, Bmax denotes the maximum number of different bits, B¯ denotes the mean changed bit number, P denotes the mean changed probability, ΔB denotes the standard deviation of numbers of changed bits, and ΔP denotes the standard deviation [13].Tables2–4 are statistical results obtained by changing one bit to M1 randomly and executing the hash algorithm N times to obtain hash values with different hash lengths of 256-, 512-, and 1024-bit. Every time, the total number of changed bits between the new and the original hash values is calculated.Table 2
Statistical result for a 256-bit hash value.
N = 256N = 512N = 1024N = 2048N = 4096Bmin10799999999Bmax145150150152153B¯128.87128.32128.29128.15128.05P%50.3450.1250.1150.0650.02ΔB7.597.957.817.807.86ΔP%2.963.113.053.053.07Table 3
Statistical results for a 512-bit hash value.
N = 256N = 512N = 1024N = 2048N = 4096Bmin229222220220220Bmax289293293299299B¯257.21257.26256.47256.08255.99P%50.2350.2450.0950.0149.99ΔB11.3311.5611.4811.4211.30ΔP%2.212.262.242.232.21Table 4
Statistical results for a 1024-bit hash value.
N = 256N = 512N = 1024N = 2048N = 4096Bmin470469462456451Bmax549555562562567B¯511.33511.03511.41511.70512.20P%49.9349.9049.9449.9750.02ΔB15.8415.5215.9416.1616.11ΔP%1.551.511.561.581.57Tables5–7 are the comparison results with other hash algorithms, and the results demonstrate that, for all the values belonging to N, the mean changed bit number B¯ is very close to the ideal number of changed bits len/2, from which we can infer that the hash algorithm has strong capability of confusion and diffusion. Meanwhile, the mean changed probability P is very close to the ideal value of 50%, which is one of the desired features of confusion. Another good feature of the hash algorithm is that both ΔP and ΔB are very small for all the tests, which means that the confusion and diffusion capability is very stable.Table 5
Comparison with other algorithms for 256-bit hash value andN = 2048.
Hash algorithmBminBmaxB¯P%ΔBΔP%SHA2-256100155127.9850.008.103.16SHA3-256 [24]100154127.9649.988.043.14[6]101168128.0850.038.123.21[22]103155128.8149.938.133.18[23]102161128.0050.008.023.13Our hash algorithm (256-bit)99152128.1550.067.803.05Table 6
Comparison with other algorithms for 512-bit hash value andN = 2048.
Hash algorithmBminBmaxB¯P%ΔBΔP%SHA2-512215292256.2750.0511.512.25SHA3-512216287254.7549.7611.322.21[22]219296255.8949.9811.272.20[23]223296256.1050.0211.122.17Our hash algorithm (512-bit)220294255.6949.9411.452.24Table 7
Comparison with other algorithms for 1024-bit hash value andN = 2048.
Hash algorithmBminBmaxB¯P%ΔBΔP%[22]450565511.8949.9916.081.57[23]461572512.0650.0015.961.55Our hash algorithm (1024-bit)450562511.7249.9715.901.55


## 4.5. Collision Analysis

### 4.5.1. Meet-in-the-Middle Attack

To seek a collision, the meet-in-the-middle attack is conducted on intermediate variables, and a collision could be found if two intermediate variables match [22, 23]. This type of attack is invalid for the proposed hash algorithm, due to the initial values of EQM serving as keys, which can make the inverse computation extremely difficult. Hence, the proposed hash algorithm can resist the meet-in-the-middle attack.


### 4.5.2. Collision Analysis

To perform a collision analysis, messageM1 with the length of L = 50 len is randomly generated, and its len-bit hash values are calculated and stored in ASCII form (8-bit per character). Then, we randomly change one bit to M1, calculate its hash value, and compare two hash values to obtain the absolute difference d between two hash values using the following equation [12]:(8)d=∑i=1len/8decei−decei′,where ei and ei′ denote the i-th ASCII character of two hash values and the function dec maps an ASCII character to its decimal value. The theoretical value of average absolute distance per character is 85.3333.In Table8, we present the minimum, maximum, and mean values of the absolute difference between two hash values, from which we can infer that when we set h = 256 and 512, the results of the proposed hash algorithm are as good as some existing hash algorithms, such as SHA-2, SHA-3, and other chaos-based hash algorithms.Table 8
Absolute difference for hash values forN = 10,000.
Absolute differenceMaximumdMinimumdMeandMeand per character256-bit [22]4,1181,7582,87889.938256-bit [23]4,1381,6862,73285.375SHA2-2563,7571,7862,77686.746SHA3-25635251,8252,74185.675Our hash algorithm (256-bit)3,9311,5732,75486.081512-bit [22]7,3693,9585,47685.563512-bit [23]7,2103,9715,46385.359SHA2-5127,1323,8405,43084.852SHA3-5126,4815,6785,61287.684Our hash algorithm (512-bit)7,0364,5325,64287.293Our hash algorithm (1024-bit)13,0418,43910,78184.226


## 4.5.1. Meet-in-the-Middle Attack

To seek a collision, the meet-in-the-middle attack is conducted on intermediate variables, and a collision could be found if two intermediate variables match [22, 23]. This type of attack is invalid for the proposed hash algorithm, due to the initial values of EQM serving as keys, which can make the inverse computation extremely difficult. Hence, the proposed hash algorithm can resist the meet-in-the-middle attack.


## 4.5.2. Collision Analysis

To perform a collision analysis, messageM1 with the length of L = 50 len is randomly generated, and its len-bit hash values are calculated and stored in ASCII form (8-bit per character). Then, we randomly change one bit to M1, calculate its hash value, and compare two hash values to obtain the absolute difference d between two hash values using the following equation [12]:(8)d=∑i=1len/8decei−decei′,where ei and ei′ denote the i-th ASCII character of two hash values and the function dec maps an ASCII character to its decimal value. The theoretical value of average absolute distance per character is 85.3333.In Table8, we present the minimum, maximum, and mean values of the absolute difference between two hash values, from which we can infer that when we set h = 256 and 512, the results of the proposed hash algorithm are as good as some existing hash algorithms, such as SHA-2, SHA-3, and other chaos-based hash algorithms.Table 8
Absolute difference for hash values forN = 10,000.
Absolute differenceMaximumdMinimumdMeandMeand per character256-bit [22]4,1181,7582,87889.938256-bit [23]4,1381,6862,73285.375SHA2-2563,7571,7862,77686.746SHA3-25635251,8252,74185.675Our hash algorithm (256-bit)3,9311,5732,75486.081512-bit [22]7,3693,9585,47685.563512-bit [23]7,2103,9715,46385.359SHA2-5127,1323,8405,43084.852SHA3-5126,4815,6785,61287.684Our hash algorithm (512-bit)7,0364,5325,64287.293Our hash algorithm (1024-bit)13,0418,43910,78184.226


## 4.6. Rainbow Table Resistance Analysis

Rainbow table is a practical example of space/time tradeoff; it uses more computer processing time at the cost of less storage when calculating a hash value on every attempt or less processing time and more storage when comparing to a simple lookup table with one entry per hash. Use of a key derivation function that employs a salt makes this attack ineffective [19]. In the proposed hash algorithm, we took two measures to make the rainbow table attack ineffective. (1) One-time keys: we assign different one-time keys by the key sequence sampled from noise to different users according to their identifications. (2) Random salt: as for equation (2), we add salt derived from the key in each iteration through perturbing the exponent k to make the rainbow table attack ineffective.


## 4.7. Speed Analysis

In order to analyze the computation speed, we implemented the proposed hash algorithm on a PC with 2.50 GHz Intel Core i7-6500U, 16G Memory and Windows 10 operation system, and the tested message consists of 20,000 ASCII characters; the speed is about 131.2 Mbps withN = 2048. Experiments showed that the running speed is unaffected by the hash value length.


## 4.8. Computational Complexity

The computational complexity [16] of the proposed hash algorithm depends on the message length and iterations of the EQM. For any message M with the character length n, there are n times to transform it into a parameter sequence, and the time complexity is O(n). For the EQM, there are n + 300 + len/16 iterations with varying parameter; hence, the time complexity is O(n). There are 140 times of addition, multiplication, and modular, hex conversion, and XOR operations, which have nothing to do with n; hence, the corresponding time complexity is O(1). Therefore, the total computational complexity of the proposed hash algorithm is O (n).


## 5. Conclusion

A novel hash algorithm is constructed based on the EQM; three measures, including assigning unique one-time keys adaptively, key expansion, and hash length extension, are taken to resist against the rainbow table attack. Three steps of message pre-encoding, message absorption, and generation of hash value are implemented. The hash algorithm is so flexible that it can be keyed or unkeyed and can generate 256-bit, 512-bit, 1024-bit, or longer hash value through a parameter switcher. Any characters, including single-byte and double-byte characters, can be transformed into a parameter sequence for EQM to absorb. Simulation results and performance analysis demonstrated the effectiveness and flexibility of the proposed hash algorithm. In the future, we intend to research chaos-based parallel hash algorithm that can resist attacks from the quantum computing.



---

*Source: 4071721-2020-07-20.xml*