Part 1: General - Computer Security Resource Center - National ...

March, 2007
APPENDIX A: Cryptographic and Non-cryptographic Integrity and
Authentication Mechanisms
Integrity and authentication services are particularly important in protocols that include key
management. When integrity or authentication services are discussed in this recommendation,
they are afforded by “strong” cryptographic integrity or authentication mechanisms. Secure
communications and key management are typically provided using a communications protocol
that offers certain services, such as integrity or a "reliable" transport service. However, the
integrity or reliable transport services of communications protocols are not necessarily adequate
for cryptographic applications, particularly for key management, and there might be confusion
about the meaning of terms such as “integrity”.
All communications channels have some noise (i.e., unintentional errors inserted by the
transmission media), and other factors, such as network congestion, can cause packets to be lost.
Therefore, integrity and reliable transport services for communications protocols are designed to
function over a channel with certain worst-case noise characteristics. Transmission bit errors are
typically detected using 1) a non-cryptographic checksum 31 to detect transmission errors in a
packet, and 2) a packet counter that is used to detect lost packets. A receiving entity that detects
damaged packets (i.e., packets in which errors have been detected) or lost packets may request
the sender to retransmit them. The non-cryptographic checksums are generally effective at
detecting transmission noise. For example, the common CRC-32 checksum algorithm used in
local area network applications detects all error bursts with a span of less than 32 bits, and
detects longer random bursts with a 2 -32 failure probability. However, the non-cryptographic
CRC-32 checksum does not detect the swapping of 32-bit message words, and specific errors in
particular message bits cause predictable changes in the CRC-32 checksum. The sophisticated
attacker can take advantage of this to create altered messages that pass the CRC-32 integrity
checks, even, in some cases, when the message is encrypted.
Forward error correcting codes are a subset of non-cryptographic checksums that can be used to
correct a limited number of errors without retransmission. These codes may be used, depending
on the application and noise properties of the channel.
Cryptographic integrity mechanisms, on the other hand, protect against an active, intelligent
attacker who might attempt to disguise his attack as noise. Typically, the bits altered by the
attacker are not random; they are targeted at system properties and vulnerabilities. Cryptographic
integrity mechanisms are effective in detecting random noise events, but they also detect the
more systematic deliberate attacks. Cryptographic hash algorithms, such as SHA-256 are
designed to make every bit of the hash value a complex, nonlinear function of every bit of the
message text, and to make it impractical to find two messages that hash to the same value. On
average, it is necessary to perform 2 128 SHA-256 hash operations to find two messages that hash
to the same value, and it is much harder than that to find another message whose SHA-256 hash
31 Checksum: an algorithm that uses the bits in the transmission to create a checksum value. The checksum value is
normally sent in the transmission. The receiver re-computes the checksum value using the bits in the received
transmission, and compares the received checksum value with the computed value to determine whether or not the
transmission was correctly received. A non-cryptographic checksum algorithm uses a well-known algorithm without
secret information (i.e., a cryptographic key).
123