2. Hashing Algorithms.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Hashing Algorithms"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The goal is to have a long message as input and produce an output which is much shorter called the hash or message digest. Furthermore, we want it to have certain properties.\n",
    "\n",
    "- **Input**: long message\n",
    "- **Output**: short fixed size block (called hash or message digest)\n",
    " \n",
    "*We want the same input always produces the same output (deterministic)*"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## *<font color=\" #6495ED\">Exercise</font>*\n",
    "\n",
    " - A *non* security related example of hash functions?\n",
    " - A security related example of hash functions?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "*** There is a difference between hash function and cryptographic hash functions ***"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Desired properties\n",
    "  - Pre-image: Given a hash *h* it is computationally infeasible to find a message *m* that produces *h*\n",
    "  - Second preimage: Given message m, it is computationally infeasible to find a message m’, (m ≠ m’) such that, h(m) = h(m’)\n",
    "  - Collisions: It is computationally difficult to find any two messages m, m’ (m ≠ m’) such that, h(m) = h(m’)\n",
    "  \n",
    "\n",
    "**Examples**:\n",
    " - Recommended Hash Algorithm (SHA-2, SHA-3) by NIST\n",
    " - <strike>SHA-1</strike>: output 160 bits being phased out (shattered.io)\n",
    " - <strike>MD2, MD4, and MD5</strike> by Ron Rivest [RFC1319, 1320, 1321]\n",
    " \n",
    "<br> \n",
    "source: shattered.io\n",
    "<br>\n",
    "<img src=\"include/shattered.png\" width=\"550\">\n",
    "<img src=\"include/shattered_diagram.png\" width=\"700\">"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### SHA Family\n",
    "\n",
    "Secure Hash Algorithm (SHA) family, is a series of hashing algorithms. Ranging from SHA-0 to SHA-3. SHA-0 should never be used, it's advised to move from SHA-1 to SHA-2. SHA-3 is the most recent version, published in 2015.\n",
    "\n",
    " * SHA-1: Digest size (160), Block size (512)\n",
    " * SHA-2: Digest size (224, 256, 384, or 512), Block size (512, 1024)\n",
    " * SHA-3: Digest size (224, 256, 384, 512), Block size (1600)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from cryptography.hazmat.backends import default_backend\n",
    "from cryptography.hazmat.primitives import hashes\n",
    "import base64 # to produce human readable encoding of the bytes\n",
    "\n",
    "digest = hashes.Hash(hashes.SHA256(), backend=default_backend())\n",
    "digest.update(b\"PyCon\")\n",
    "digest.update(b\"2017\")\n",
    "msg_digest = digest.finalize()\n",
    "# Notice the output size of the digest\n",
    "print (\"msg_digest:\", len(msg_digest), len(msg_digest) * 8)\n",
    "print (\"base64 encoding:\", base64.b64encode(msg_digest))\n",
    "\n",
    "print()\n",
    "\n",
    "digest = hashes.Hash(hashes.SHA256(), backend=default_backend())\n",
    "digest.update(b\"PyCon2017\")\n",
    "msg_digest = digest.finalize()\n",
    "# Notice the output size of the digest\n",
    "print (\"msg_digest:\", len(msg_digest), len(msg_digest) * 8)\n",
    "print (\"base64 encoding:\", base64.b64encode(msg_digest))\n",
    "\n",
    "print()\n",
    "\n",
    "digest = hashes.Hash(hashes.SHA256(), backend=default_backend())\n",
    "digest.update(b\"PyCon 2017\")\n",
    "msg_digest = digest.finalize()\n",
    "# Notice the output size of the digest\n",
    "print (\"msg_digest:\", len(msg_digest), len(msg_digest) * 8)\n",
    "print (\"base64 encoding:\", base64.b64encode(msg_digest))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## *<font color=\" #6495ED\">Exercise</font> *\n",
    "\n",
    " - Let's explore what other hashing algorithms are available and use a different one.\n",
    " - Change \"PyCon2017\", to PyCon 2017\" and see check the result"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Python Builtin Support"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "*\"Additional algorithms may also be available depending upon the OpenSSL library that Python uses on your platform. On most platforms the sha3_224(), sha3_256(), sha3_384(), sha3_512(), shake_128(), shake_256() are also available.\"*\n",
    "\n",
    "source: https://docs.python.org/3/library/hashlib.html"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import hashlib\n",
    "sha256 = hashlib.sha256()\n",
    "sha256.update(b\"PyCon2017\")\n",
    "\n",
    "msg_digest = sha256.digest()\n",
    "# Notice the output size of the digest\n",
    "print (\"msg_digest:\", len(msg_digest), len(msg_digest) * 8)\n",
    "print (\"base64 encoding:\", base64.b64encode(msg_digest))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## *<font color=\" #6495ED\">Exercise</font> *\n",
    "\n",
    " - Let's see what other hashing algorithms our python supports."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Hash-based message authentication code (HMAC)\n",
    "\n",
    "HMACs are used for message authentications combined with a secret key. This provide integrity checking and authentication. An attacker can not forge the digest without knowing the secret key.\n",
    "\n",
    "<img src=\"include/SHAhmac.png\" width=\"600\">\n",
    "\n",
    "image source: wikipedia"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "$ HMAC(K,m) = H((K\\oplus opad) || H((K \\oplus ipad) || m))$"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### HMAC Calculation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from cryptography.hazmat.backends import default_backend\n",
    "from cryptography.hazmat.primitives import hmac, hashes\n",
    "import os\n",
    "import base64\n",
    "\n",
    "hmc_key = k = os.urandom(16)\n",
    "hmc = hmac.HMAC(hmc_key, hashes.SHA1(), default_backend())\n",
    "hmc.update(b\"PyCon2017\")\n",
    "hmc_sig = hmc.finalize()\n",
    "print (base64.b64encode(hmc_sig))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### HMAC Verification"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Verification Successufl\n",
    "hmc = hmac.HMAC(hmc_key, hashes.SHA1(), default_backend())\n",
    "hmc.update(b\"PyCon2017\")\n",
    "hmc.verify(hmc_sig)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Verification Fails\n",
    "hmc = hmac.HMAC(hmc_key, hashes.SHA1(), default_backend())\n",
    "hmc.update(b\"PyCon2017\")\n",
    "hmc.verify(hmc_sig+b\"1\")"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.1"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}