Mask generation function: Difference between revisions

Revision as of 17:44, 24 October 2018

Latest revision as of 20:03, 8 April 2024

(26 intermediate revisions by 17 users not shown)

Line 1:

{{Short description|Cryptographic tool}}

A '''Mask Generation Function''' ('''MGF''') is a cryptographic primitive similar to a [[Cryptographic hash function]] except that while a hash function's output is a fixed size, a MGF supports output of a variable length. In this respect, a MGF can be viewed as a single-use [[Sponge function]], it can absorb any length of input and process it to produce any length of output. Mask Generation Functions are completely deterministic. For any given input and desired output length the output is always the same.

{{Use American English|date = April 2019}}

A '''Maskmask Generationgeneration Functionfunction''' ('''MGF''') is a cryptographic primitive similar to a [[Cryptographiccryptographic hash function]] except that while a hash function's output ishas a fixed size, a MGF supports output of a variable length. In this respect, a MGF can be viewed as a single-use [[Spongeextendable-output function]], (XOF): it can absorbaccept any lengthinput of inputany length and process it to produce any lengthoutput of outputany length. Mask Generationgeneration Functionsfunctions are completely deterministic.: Forfor any given input and any desired output length the output is always the same.

== Definition ==

Line 9 ⟶ 11:

== Applications ==

Mask Generationgeneration Functionsfunctions, as generalizations of hash functions, are useful in all the same caseswherever hash functions are useful. However, use of a MGF is desirable in cases where a fixed-size hash would be inadequate. Examples include generating [[Padding (cryptography)|padding]], producing [[Oneone-time pad|one time pads]]s or [[keystream|keystreams]] in [[Symmetric-key_algorithm|symmetric -key encryption]], and yielding outputs for [[pseudorandom number generator|pseudorandom number generators]]s.

=== Padding Schemesschemes ===

Mask Generationgeneration Functionsfunctions were first proposed as part of the specification for padding in the [[Optimal_asymmetric_encryption_padding|RSA-OAEP]] algorithm. The OAEP algorithm required a cryptographic hash function that could generate an output equal in size to a "data block" whose length was proportional to arbitrarily sized input message.<ref name="rsa"/>

=== KeyedRandom Encryptionnumber generators ===

The NIST Special Publication 800-90A<ref>{{cite webjournal |url=http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf | title=Recommendation for Random Number Generation Using Deterministic Random Bit Generators |author=National Institute of Standards and Technology|year=2012 |doi=10.6028/NIST.SP.800-90A }}</ref> defines a class of cryptographically secure random number generators, one of which is the "Hash &nbsp;DRBG", which uses a hash function with a counter to produce a requested sequence of random bits equal in size to the requested number of random bits.

The [[Salsa20]] stream cipher may be viewed as a Mask Generation Function as its [[keystream]] is produced by hashing the key and nonce with a counter, to yield an arbitrarily long output.<ref>{{cite web |url=https://cr.yp.to/snuffle/salsafamily-20071225.pdf | title=The Salsa20 family of stream ciphers |author=Daniel J. Bernstein}}</ref>

<pre>

"Salsa20 generates the stream in 64-byte (512-bit) blocks. Each block is an

independent hash of the key, the nonce, and a 64-bit block number; there is no

chaining from one block to the next. The Salsa20 output stream can therefore

be accessed randomly, and any number of blocks can be computed in parallel."

</pre>

=== Random Number Generators ===

The NIST Special Publication 800-90A<ref>{{cite web |url=http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf | title=Recommendation for Random Number Generation Using Deterministic Random Bit Generators |author=National Institute of Standards and Technology}}</ref> defines a class of cryptographically secure random number generators, one of which is the "Hash DRBG" which uses a hash function with a counter to produce a requested sequence of random bits equal in size to the requested number of random bits.

== Examples ==

Perhaps the most common and straight forwardstraightforward mechanism to build a MGF is to iteratively apply a hash function together with an incrementing counter value. The counter may be incremented indefinitely to yield new output blocks until a sufficient amount of output is collected. This is the approach used in MGF1 shown below.

=== MGF1 ===

MGF1 is a Maskmask Generationgeneration Functionfunction defined in the Public Key Cryptography Standard #1 published by RSA Laboratories:<ref name="rsa"/>:

<blockquote>

====Options====

Line 67 ⟶ 58:

</blockquote>

=== Example Codecode ===

Below is the pythonPython code implementing MGF1:

<sourcesyntaxhighlight lang="python">

import hashlib

def mgf1(inputseed: bytes, length: int, hashhash_func=hashlib.sha1) -> bytes:

def i2osp(integer, size=4):

"""Mask generation function."""

return ''.join([chr((integer >> (8 * i)) & 0xFF) for i in reversed(range(size))])

hLen = hash_func().digest_size

# https://www.ietf.org/rfc/rfc2437.txt

def mgf1(input, length, hash=hashlib.sha1):

# 1. If l > 2^32(hLen), output "mask too long" and stop.

counter = 0

if length > (hLen << 32):

output = ''

raise ValueError("mask too long")

while (len(output) < length):

# 2. Let T be the empty octet string.

C = i2osp(counter, 4)

T = b""

output += hash(input + C).digest()

# 3. For counter from 0 to \lceil{l / hLen}\rceil-1, do the following:

counter += 1

# Note: \lceil{l / hLen}\rceil-1 is the number of iterations needed,

return output[:length]

# but it's easier to check if we have reached the desired length.

</source>

counter = 0

while (len(outputT) < length):

# a. Convert counter to an octet string C of length 4 with the primitive I2OSP: C = I2OSP (counter, 4)

C = int.to_bytes(counter, 4, "big")

# b. Concatenate the hash of the seed Z and C to the octet string T: T = T || Hash (Z || C)

output T += hashhash_func(inputseed + C).digest()

C = i2osp( counter, 4)+= 1

# 4. Output the leading l octets of T as the octet string mask.

return outputT[:length]

</syntaxhighlight>

Example outputs of MGF1:

<sourcesyntaxhighlight lang="pythonpycon">

Python 23.710.64 (defaultmain, SepApr 16 9 20142022, 1516:0428:3641) [GCC 8.3.0] on linux

[GCC 4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.39)] on darwin

Type "help", "copyright", "credits" or "license" for more information.

>>> from mgf1 import mgf1

>>> from binascii import hexlify

>>> from hashlib import sha256

>>> hexlify(mgf1('b"foo'", 3).hex()

'1ac907'

>>> hexlify(mgf1('b"foo'", 5).hex()

'1ac9075cd4'

>>> hexlify(mgf1('b"bar'", 5).hex()

'bc0c655e01'

>>> hexlify(mgf1('b"bar'", 50).hex()

'bc0c655e016bc2931d85a2e675181adcef7f581f76df2739da74faac41627be2f7f415c89e983fd0ce80ced9878641cb4876'

>>> hexlify(mgf1('b"bar'", 50, sha256).hex()

'382576a7841021cc28fc4c0948753fb8312090cea942ea4c4e735d10dc724b155f9f6069f289d61daca0cb814502ef04eae1'

</syntaxhighlight>

</source>

== References ==

{{reflist}}

[[Category:Articles with example Python (programming language) code]]

[[Category:Cryptography]]

[[Category:Cryptographic primitives]]

[[Category:Cryptographic hash functions]]