Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 10118 — Information Technology — Security Techniques — Hash-Functions Series
Information Technology — Security Techniques — Hash-Functions (1998–2016 Editions, 4 Parts)
🧮 BS ISO/IEC 10118 is the British Standard implementation, adopted by BSI, of the ISO/IEC 10118 international series prepared by Technical Committee IST/33 (IT — Security techniques) and its subcommittee IST/33/2 (Cryptography and Security Mechanisms), classified under ICS 35.040. The series provides standardized definitions and constructions for hash-functions, specifying general requirements, constructions using an n-bit block cipher, dedicated hash-functions, and hash-functions using modular arithmetic. It is the foundational standard for data integrity verification, digital signatures, and message authentication.
💡 Hash-functions are the “workhorse” of cryptography: they compress an arbitrary-length message into a fixed-length digest, with one-wayness and collision resistance. By standardizing constructions and security properties, BS ISO/IEC 10118 makes the security strength of different implementations verifiable.
1. Series Overview 📌
The BS ISO/IEC 10118 series consists of several parts; this batch covers Parts 1, 2, 3, and 4. Part 1 is the general part, giving general requirements, terms, symbols, and coding conventions for hash-functions; Part 2 specifies constructions using an n-bit block cipher; Part 3 specifies dedicated hash-functions; Part 4 specifies hash-functions using modular arithmetic. The series supersedes earlier editions and incorporates several amendments and corrigenda, with Part 3 incorporating Amendment 1:2006.
The series primarily serves cryptographic algorithm and protocol designers, PKI and certificate-system implementers, smart card and secure-chip vendors, code-signing and software supply-chain security practitioners, and cryptographic security evaluation and compliance auditors.
2. Structure and Technical Highlights 📋
| Standard | Title | Core Content |
|---|---|---|
| BS ISO/IEC 10118-1:2016 | General | General requirements, terms, symbols, and coding conventions for hash-functions, providing a common framework for the other parts |
| BS ISO/IEC 10118-2:2010 | Hash-functions using an n-bit block cipher | Methods for constructing hash-functions using an n-bit block cipher, including Padding methods 1 and 2 |
| BS ISO/IEC 10118-3:2003 | Dedicated hash-functions | Algorithms designed specifically for hashing (e.g., iteration-based structures), incorporating Amendment 1 (2006) |
| BS ISO/IEC 10118-4:1998+A1:2014 | Hash-functions using modular arithmetic | Hash-functions constructed using modular arithmetic (e.g., modulo 2m), incorporating A1:2014 (scanned version, written from public-domain knowledge) |
⚠️ BS ISO/IEC 10118-4 in this material is a scanned version; its description is written from public-domain knowledge of the standard. Please refer to the official BSI publication for the authoritative text.
3. Key Technical Requirements 🔧
The key technical requirements of the BS ISO/IEC 10118 series center on the construction and security properties of hash-functions:
- One-wayness: given a hash value, it is hard to recover the corresponding input message.
- Collision resistance: it is hard to find two different messages producing the same hash value — crucial for digital signature security.
- Padding methods (Part 2): specifies two padding methods (Padding 1 and Padding 2) ensuring arbitrary message length and correct input encoding, avoiding length-extension attacks.
- Iterative structure (Part 3): dedicated hash-functions typically use Merkle-Damgård or sponge structures to extend a fixed-length compression function to arbitrary-length input.
- Modular arithmetic construction (Part 4): hash-functions based on modulo 2m and similar operations, leveraging number-theoretic hard problems for security.
- Security strength and output length: output length determines collision-resistance strength; the standard specifies recommended parameter ranges for different constructions.
🚨 The security strength of hash-functions degrades as cryptanalysis advances. Algorithms known to have weaknesses or insufficient output length (e.g., early MD5, SHA-1 in security contexts) should be avoided; prefer standard-recognized modern algorithms with adequate output length.
4. Engineering Practice Applications 🛠️
In engineering practice, the BS ISO/IEC 10118 series is mainly applied to:
- 🔍 Digital signatures and certificates: the message is hashed first, then the digest signed — a core step of PKI certificates and digital signatures.
- 🔧 Data integrity verification: verify whether data has been altered or corrupted by comparing hash values during file transfer, software download, and storage.
- 📊 Code signing and supply-chain security: software publishers hash and sign installation packages, ensuring code trustworthiness along the distribution chain.
- 📋 Password storage and key derivation: store passwords hashed (optionally salted) to avoid plaintext exposure on database breach; also used for key derivation.
✅ It is recommended that cryptographic system designers select recognized hash-functions per the BS ISO/IEC 10118 series, combine them with ISO/IEC 9797 (message authentication codes) and ISO/IEC 14888 (digital signatures) to build complete security schemes, and periodically assess the security margin of chosen algorithms.
5. Frequently Asked Questions ❓
❓ Q: What is the difference between a hash-function and a message authentication code (MAC)?
A: A hash-function is public and keyless, detecting data integrity but providing no authentication (anyone can compute it); a MAC uses a key in computation, detecting both integrity and authenticating the sender. They are often used together.
A: A hash-function is public and keyless, detecting data integrity but providing no authentication (anyone can compute it); a MAC uses a key in computation, detecting both integrity and authenticating the sender. They are often used together.
❓ Q: Why is collision resistance so important?
A: Digital signatures usually sign the hash value of a message. If an attacker can construct two different messages with the same hash, they can trick a victim into verifying a signature over a malicious message, forging signatures. Collision resistance prevents such “hash collision” attacks.
A: Digital signatures usually sign the hash value of a message. If an attacker can construct two different messages with the same hash, they can trick a victim into verifying a signature over a malicious message, forging signatures. Collision resistance prevents such “hash collision” attacks.
❓ Q: How does padding affect security?
A: Padding ensures the input message is correctly encoded with unambiguous length, preventing different messages from mapping to the same internal state. Improper padding may enable length-extension attacks, letting an attacker extend a signed message without knowing the key.
A: Padding ensures the input message is correctly encoded with unambiguous length, preventing different messages from mapping to the same internal state. Improper padding may enable length-extension attacks, letting an attacker extend a signed message without knowing the key.
❓ Q: How do Part 2 “block-cipher-based” and Part 3 “dedicated” hash-functions differ?
A: Part 2 constructs hash-functions using existing block ciphers (e.g., AES, TDEA), reusing existing encryption hardware; Part 3 covers algorithms designed specifically for hashing (e.g., SHA family), typically faster and more streamlined. Choice depends on available hardware and security needs.
A: Part 2 constructs hash-functions using existing block ciphers (e.g., AES, TDEA), reusing existing encryption hardware; Part 3 covers algorithms designed specifically for hashing (e.g., SHA family), typically faster and more streamlined. Choice depends on available hardware and security needs.
❓ Q: How does output length affect security strength?
A: Collision-resistance strength is about half the output length (birthday attack); preimage resistance about the full output length. Shorter output means smaller security margin — ensure the chosen hash’s output length is sufficient against current computing capability.
A: Collision-resistance strength is about half the output length (birthday attack); preimage resistance about the full output length. Shorter output means smaller security margin — ensure the chosen hash’s output length is sufficient against current computing capability.