I am curious whether there is a difference between AES encryption and hash function > with the strong assumptions as below:
A. The key of the AES is never exposed. (Without knowing the key, I believe there is > no possibility of decryption and hence one-way function as a hash)
B. For some applications, the input size is always fixed.
if someone uses AES encryption as the purpose of hash, do any possible
There are some differences, because in symetric cryptography, block ciphers (which AES belongs to) and Hash functions are not used for the same purpose most of the time, so you will face a different set of problems.
A first assumption would be that hash functions, like block ciphers, from an input makes its output no more meaningful for humans (confidentiality), which seems true, but it is much more complex than that.
Hash functions are designed to be fast. Their goal is to reduce the number of input bits to an arbitrary fixed length (depending on the function). A common-used case is to check the integrity of two packs of data that can be of any representation (eg. A whole Hard Drive, one or multiple files(s), a string in a program or database, arbitrary bits...). Calculating and comparing two hashes is thus faster than comparing the whole data.
Brute forcing: Hash functions are by construction not inversible. But lookup tables do exist to retrieve calculated values, (eg. for passwords, random strings... ). It is possible to check the content of lookup tables online with dedicated websites. They store them as database data. If a hash is not already calculated in the lookup table, it is also possible to bruteforce a hash to retrieve its value.
Collisions: Hash functions can have collisions (two different inputs give the same output). This makes the integrity check ineffective. Cryptographic Hash Functions try to protect themselves against the possibility of forgery (the creation of input data with the same hash as the expected data, a collision) by potentially malicious participants.
Symetric cryptography: AES block cipher
AES is a block cipher that uses 128, 192, 256-bits key lenght with blocks of 128 bits. Block ciphers encrypt a ciphertext from plaintext with a secret key.
An attacker stole the key:
We suppose no problems of key sharing in your scenario. The key is still located somewhere in your system, so the attackers can attack it to retrieve the key. Securely storing cryptographic keys is a hard problem to solve. Even if it is not shared here, since the key has to change after a certain amount of usage.If available, it is better to use dedicated/ software hardware like HSM or keyvaults. Encrypting the key with another key should be done. But it only translates the existing problems to another key.
The key should change:
- If the previous key is (or suspected) to have been compromised. This could also be caused by someone who had access to the key leaving the organisation.
- After a specified period of time has elapsed (known as the cryptoperiod). There are many factors that could affect what an appropriate cryptoperiod is. This include the size of the key, the sensitivity of the data, and the threat model of the system.-
- After the key has been used to encrypt a specific amount of data.This would typically be 2^35 bytes (~34GB) for 64-bit keys and 2^68 bytes (~295 exabytes) for 128-bit block size.
- If there is a significant change to the security provided by the algorithm (such as a new attack being announced). There are two main approaches for how existing data that was encrypted with the old key(s) should be handled:
- Decrypting it and re-encrypting it with the new key.
- Marking each item with the ID of the key that was used to encrypt it, and storing multiple keys to allow the old data to be decrypted.The first option should generally be preferred, as it greatly simplifies both the application code and key management processes; however, it may not always be feasible.
Brute-forcing of the Key:
Trying all possibilities for the 128, 192, 256 bits of the key. This to retreive meningful content from the output. Most of the time, too computably expensive but always works in theory
- Exploitable Mathematical vulnerability in AES. Some do exist, but not all are interesting to exploit from a practical perspective.
- Vulnerability in the cryptographic library implementation: some common libraries provide AES encryption. They do have exploitable vulnerabilities from time to time. It is much better to use a used, industry standard, updated cryptographic library.
- Vulnerability in your code implementing the cryptographic library.
- Vulnerability in the hardware (here CPU) implementing AES specific instructions.
Performing AES can be more computably expensive than a Hash function. It is slower by design, but it may or not be a real problem considering your use case.
Choosing a cipher Mode for AES:
Not all cipher modes provide the same security. Some modes can introduce specific vulnerabilities. In most cases, GCM outperforms the ECB, CBC and PCBC modes.
As we have seen, in your scenario, most problems with AES relate to key management and securisation. Hash function do have other problems but it can be mitigated with the usage of a recent, secured cryptographic hash function recomanded by standards. This is why people tend to prefer to use such cryptographic hash functions over Block ciphers in this kind of use case.