2

This is the ultimate noob question.

When reading discussions of cryptography, I often come across phrases like these:

...calculates a hash over the primary key...

...a key derivation function over a static string...

...an HMAC over the i-th derived key...

Is "over" in these examples just a hip way to say "of"?

More concretely, is there a real technical difference between the sentences above and their counterparts below?

...calculates a hash of the primary key...

...a key derivation function of a static string...

...an HMAC of the i-th derived key...

kjo
  • 1,063
  • 2
  • 9
  • 17

1 Answers1

1

A hash (or MAC or signature) over something is a hash of that thing at an identifiable position, plus some other stuff. It's a hash of M=P+T+S where P is some prefix, T is the thing and S is some suffix, and there is an unambiguous way of decomposing M into P, T and S.

For example, a certificate of a website is a signature over the site's domain name and its public key. It isn't just a signature of the domain name or a signature of the public key: it's a signature of a compound message from which the domain name and the public key can be extracted.

A hash over something gives the same integrity guarantee as a hash of that thing: if the thing is replaced by a different thing, the hash won't be the same. It's a useful concept because a lot of data formats don't take a hash of just the thing you're talking about at a given time: the hashed message can contain other metadata and data that aren't that one thing. It's especially important with a signature because a signature over two pieces of data is stronger than a signature over each piece separately. Taking the example of certificates again, a signature over a domain name and another signature over a public key would not be very useful, but a signature over a domain name and another signature tie them together in a very useful way.

A hash/MAC/signature over something can also mean a deeper construction, such as a hash of a string containing (in an unambiguous way) a hash of etc. For example, a signature of a hash of a message containing a hash of a second message containing a hash of a thing is a signature over that thing, because it guarantees the authenticity of that thing just like a signature of the thing itself would.

Gilles 'SO- stop being evil'
  • 51,955
  • 14
  • 122
  • 182