Overview
ISO/IEC 10118-4:1998 specifies two modular-arithmetic based hash-functions - MASH-1 and MASH-2 (Modular Arithmetic Secure Hash). These functions compress messages of arbitrary but limited length into a fixed-length hash-code. The output length is determined by the length of the prime p used in the standard’s reduction-function, allowing the hash size to be scaled to match the input requirements of other mechanisms (for example, signature algorithms or identification schemes). The algorithms are designed to be collision-resistant under standard number-theoretic assumptions.
Key topics and technical requirements
- Modular arithmetic round-function: A round-function φ combines expanded data blocks with previous outputs using modular operations modulo a composite modulus N.
- Two variants:
- MASH-1 uses exponent e = 2 in the round-function.
- MASH-2 uses exponent e = 257; otherwise the two differ only by exponent.
- Reduction-function (RED): After iterative rounds, a reduction modulo a prime p produces the final hash-code of length determined by p.
- Data preparation: The hashing procedure includes padding, appending the original length, splitting into half-blocks, and expansion (inserting fixed half-bytes), as specified in the standard.
- Security constraints:
- The modulus N must be a composite integer (product of two primes) chosen so that factoring N is computationally infeasible.
- The factors of N should remain secret (trusted generation or secure multiparty methods).
- The reduction prime p must not divide N, its length is at most half the bit-length of N, and its top three bits should be ones to avoid unbalanced reductions.
- Initialization: The initializing value IV is all-zero string of the block length Lφ.
- Identifiers: Hash-function identifiers are defined (MASH-1 = 0x41, MASH-2 = 0x42).
Applications and who would use it
- Cryptographers and security engineers who need hash-functions compatible with existing modular-arithmetic infrastructure (e.g., systems already supporting large-modulus arithmetic).
- Implementers of digital signature schemes and identification protocols where the hash length must match modulus- or key-dependent input sizes.
- Standards bodies and evaluators assessing alternative hash constructions based on number-theoretic assumptions.
- Suited for environments where modular-root and factoring hardness are acceptable security bases and where efficient modular-arithmetic implementations are available.
Related standards
- ISO/IEC 10118-1: General definitions and conventions for hash-functions.
- Other parts of ISO/IEC 10118: Part 2 (block-cipher based) and Part 3 (dedicated hash-functions) for alternative hash-function families.
Keywords: ISO/IEC 10118-4:1998, hash-functions, modular arithmetic, MASH-1, MASH-2, collision-resistant, modulus N, prime p, reduction-function, round-function, hash-code.