|LETTER TO EDITOR
|J Pathol Inform 2017,
Compromising the security of “Generating unique identifiers from patient identification data using security models”
Sydney Medical School, The University of Sydney, NSW 2006; Informatics Committee, The Royal College of Pathologists of Australasia, NSW 2010, Australia
|Date of Submission||01-Jan-2017|
|Date of Acceptance||23-Feb-2017|
|Date of Web Publication||10-Apr-2017|
Sydney Medical School, The University of Sydney, NSW 2006
Source of Support: None, Conflict of Interest: None
|How to cite this article:|
Schlosberg A. Compromising the security of “Generating unique identifiers from patient identification data using security models”. J Pathol Inform 2017;8:17
I write with respect to the Technical Note “Generating unique identifiers (IDs) from patient identification data using security models,” the authors of which propose a method to “create a unique one-way encrypted ID per patient that can be used for data sharing.” In summary, their method involves concatenation of a patient's date of birth, sex, and surname, utilizing either the MD5 or SHA-1 cryptographic hash of this value as the record ID.
The authors conclude that this “can be used to share patient electronic medical records between practitioners without revealing patients' identifiable data.” Here, I demonstrate that this is not the case and wish to recommend that the method should not be utilized under circumstances in which the privacy of underlying patient data is required.
The authors state that “the difficulty of coming up with any message having a given MD is on the order of 2128 operations;” however, even in the absence of known weaknesses in the MD5 algorithm, this assumes an unbounded input space. The proposed methodology is strictly limited by the number of feasible birth dates, names, and sexes – excluding leap days and assuming only binary sexes, the input space for a 100-year period is only 73,000 per surname.
It is thus possible to perform a brute-force, precomputed attack utilizing common surnames. Known as a rainbow table, I calculated the proposed IDs for two sexes, birth dates spanning all of the century 1917–2016 inclusive, and the top ten most common surnames in the 2000 USA census. This approach reduces the search space to < 223 and performed on my personal laptop; computation took a mere 8.8 s to compromise the IDs of over 13 million people (based on census counts) for both MD5 and SHA-1. The results of my calculations are available for download at https://goo.gl/xqwphs and constitute a reverse-lookup database that fully compromises the security of the proposed method.
It is trivial to modify the input format for the precomputed IDs and to extend the rainbow table to cover more surnames; nevertheless, the secrecy of the input format would not contribute to security, under Kerckhoffs' principle (French original; English elucidation ). Given the independence between IDs, this brute-force process is known as embarrassingly parallel, allowing for computation to be shared across any number of devices (without modifying code) which results in a decreased time for compromise. A number of other weaknesses exist in the proposed methodology, but I limit myself to detailing the most severe one in the interest of being succinct.
Financial support and sponsorship
Conflicts of interest
There are no conflicts of interest.
| References|| |
Mohammed EA, Slack JC, Naugler CT. Generating unique IDs from patient identification data using security models. J Pathol Inform 2016;7:55. [Full text]
Wang X, Yu H. In: Advances in Cryptology-EUROCRYPT. Berlin: Springer; 2005. p. 19-35.
Kerckhoffs A. La cryptographie militaire. J Sci Mil 1883;IX: 5-38.
Schlosberg A. Data security in genomics: A review of Australian privacy requirements and their relation to cryptography in data storage. J Pathol Inform 2016;7:6. [doi: 10.4103/2153-3539.175793].
Maurice H, Nir S. The Art of Multiprocessor Programming, Revised Reprint. Revised Edition. San Francisco, United States: Elsevier; 2012. p. 14.