An empirical comparison of widely adopted hash functions in digital forensics: does the programming language and operating system make a difference?

Détails

ID Serval
serval:BIB_8DD5C97588D4
Type
Actes de conférence (partie): contribution originale à la littérature scientifique, publiée à l'occasion de conférences scientifiques, dans un ouvrage de compte-rendu (proceedings), ou dans l'édition spéciale d'un journal reconnu (conference proceedings).
Collection
Publications
Titre
An empirical comparison of widely adopted hash functions in digital forensics: does the programming language and operating system make a difference?
Titre de la conférence
Proceedings of the Conference on Digital Forensics, Security and Law
Auteur(s)
Satyendra Gurjar, Baggili Ibrahim, Breitinger Frank, Fischer Alice
Statut éditorial
Publié
Date de publication
2015
Pages
57-68
Langue
anglais
Résumé
Hash functions are widespread in computer sciences and have a wide range of applications such as ensuring integrity in cryptographic protocols, structuring database entries (hash tables) or identifying known files in forensic investigations. Besides their cryptographic requirements, a fundamental property of hash functions is efficient and easy computation which is especially important in digital forensics due to the large amount of data that need to be processed in cases. In this paper, we correlate the runtime efficiency of common hashing algorithms (MD5, SHA-family) and their implementation. Our empirical comparison focuses on C-OpenSSL, Python, Ruby, Java on Windows and Linux and C‰ and WinCrypto API on Windows. The purpose of this paper is to recommend appropriate programming languages and libraries for coding tools that include intensive hashing functionality. In each programming language, we compute the MD5, SHA-1, SHA-256 and SHA-512 digest on datasets from 2 MB to 1 GB. For each language, algorithm and data, we perform multiple runs and compute the average elapsed time. In our experiment, we observed that OpenSSL and languages utilizing OpenSSL (Python and Ruby) perform better across all the hashing algorithms and data sizes on Windows and Linux. However, on Windows, performance of Java (Oracle JDK) and C WinCrypto is comparable to OpenSSL and better for SHA-512.
Mots-clé
Digital forensics, hashing, micro benchmarking, security, tool building
Création de la notice
06/05/2021 12:01
Dernière modification de la notice
06/05/2021 12:47
Données d'usage