Re: [Cfrg] erratum for hmac what do we think...

Speaking not as an HMAC expert but as an application security guy, while I
agree that the ares where the design of HMAC could be improved, the
vulnerability described in the proposed errata is, in my opinion, less a
security issue with HMAC, and more a security issue with a badly designed
system.  I can immediately think of several ways to mitigate the threat,
not the least of which is simply not to build a system that stores
plaintext hashes of bare keys.

As we all well know, virtually any cryptographic design can (and will!) be
implemented badly in ways that introduce vulnerability, when the
implementer doesn't understand the system he or she is implementing, which
is exactly what the scenario in question seems to be.   Generally speaking,
I think HMAC is easier than most to implement reasonably securely, and even
where it is not, this particular case is not where it is likeliest to fail.
  Short colliding keys as Kenny mentioned are certainly a bigger issue, and
weak keys and non-constant-time comparison are other issues I see regularly
in real systems.

On a tangent, purely as personal opinion, errata is a great tool for fixing
mistakes and adding clarification.  It's a lousy way to propose a
fundamental breaking change to an RFC that's been published for 19 years
and is already baked into who-knows-how-many systems in its current
specification.

Best regards,

-Xander Sherry

On Thu, Feb 2, 2017 at 9:07 AM, Paterson, Kenny <Kenny.Paterson@rhul.ac.uk>
wrote:

> Dear CFRG,
>
> It'd be great if some HMAC experts could take a look at this proposed
> erratum and give a view on it.
>
> I looked quickly myself. It's an undesirable property, but I don't think
> it's disastrous (yes, I could invent scenarios where one could come
> unstuck because of it). It reminds me somewhat of the well-known, and
> again somewhat unfortunate, fact that HMAC keys of different lengths can
> end up being padded to form colliding keys.
>
> Cheers,
>
> Kenny
>
> On 02/02/2017 02:24, "Cfrg on behalf of Stephen Farrell"
> <cfrg-bounces@irtf.org on behalf of stephen.farrell@cs.tcd.ie> wrote:
>
> >
> >Hiya,
> >
> >There's an erratum posted for hmac [1] where I'd be
> >interested in what folks here think.
> >
> >I'm unsure if this is a real problem, esp given that
> >there are I guess a lot of implementations.
> >
> >And even if it were a real problem, I'm not sure we'd
> >want that fix.
> >
> >Opinions welcome...
> >
> >Thanks,
> >S.
> >
> >[1]
> >https://www.rfc-editor.org/errata_search.php?rfc=2104&
> eid=4809&rec_status=
> >15&area_acronym=&errata_type=&wg_acronym=&submitter_name=&
> stream_name=&sub
> >mit_date=&presentation=records
> >
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>