Guidelines released for secure use of digital signatures, hashing
Connecting state and local government leaders
Two new publications from NIST provide guidance for randomizing message input for digital signatures and for using hash algorithms
Guidelines for secure use of approved hash algorithms have been updated by the National Institute of Standards and Technology, providing the technical specifications for the latest Federal Information Processing Standards (FIPS).
Special Publication 800-107, titled “Recommendation for Applications Using Approved Hash Algorithms,” provides guidelines for achieving the needed level of security when using algorithms approved in FIPS 180-3. Hash functions compute a fixed-length digest, or hash, for a document or message, which can be used to assure that a document has not been altered.
The agency also has released guidelines for assuring that digitally signed documents cannot be tampered with by a second party. Special Publication 800-106, titled “Randomized Hashing for Digital Signatures,” specifies ways to enhance the security of cryptographic hash functions used in digital signatures by randomizing the message.
FIPS 180-3 is a streamlined standard for secure hash algorithms that replaced its predecessor standard in October. It added a new algorithm to the list of those approved for use in federal IT systems and removed many of the technical specifics to make the standard more flexible. Because of research into weaknesses and vulnerabilities in hash functions, some technical information contained in the old standard was no longer accurate. “Therefore, the technical information has been removed from the revised standard and will be provided in Special Publications, which can be updated in a timely fashion as the technical conditions change,” the Commerce Department wrote in announcing the approval of the new standard.
Government systems, except national security systems, must use approved cryptographic hash functions specified in FIPS 180-3. Currently, there are five approved hash algorithms: SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512. These hash algorithms produce outputs of 160, 224, 256, 384 and 512 bits, respectively. The output of a hash algorithm is commonly known as a message digest, a hash value or a hash output.
“A cryptographic hash function that is not suitable for one application might be suitable for other cryptographic applications that do not require the same security properties,” NIST says in SP 800-107. The publication gives the strengths of each approved algorithm for different considerations, including collision resistance, preimage resistance and second preimage resistance.
The hash produced for a digital signature serves the same purpose on electronic documents as traditional written signatures on printed documents. Their reliability is based on the privacy of the key used by the signer, and the fact that the hash produced by the signing key should be unique for each message or document.
But hash-function collisions, in which two message produce the same hash, are possible. This could allow a second party preparing a document for signature to later alter that document without detection.
“Cryptographic hash functions have been designed with collision resistance as a major goal, but the current concentration on attacking cryptographic hash functions may result in a given cryptographic hash function providing less collision resistance than expected,” the publication explains. “Randomized hashing offers the signer additional protection by reducing the likelihood that a preparer can generate two or more messages that ultimately yield the same hash value during the digital signature generation process — even if it is practical to find collisions for the hash function.”
NIST does not require the use of randomized hashing, and application designers should select hash functions believed to be collision resistant. A party should consider using randomized hashing whenever it prepares a full or partial message for signature by another party.
“The randomization method specified in this recommendation is an approved method for randomizing messages prior to hashing,” the publication states. “The method will enhance the security provided by the approved cryptographic hash functions in certain digital signature applications. Other randomization techniques may be used, but NIST makes no claims regarding their effect on security.”
NEXT STORY: Government data breaches on the decline