Re: [Cfrg] erratum for hmac what do we think...

[David Jacobson <[e-mail]>]

On 2/3/17 2:24 AM, Peter Gutmann wrote:
> Hugo Krawczyk <[e-mail]> writes:
>
>> For example, people wanted to use unlimited passphrases, and between having
>> people truncate long keys or hash them first, the latter seemed the more
>> robust solution. (BTW, the right way to deal with these issues using HMAC is
>> to use HKDF.)
> Another solution to the fact that there are two external-format keys that map
> to a single internal-format key (i.e. the > blocksize key and its hash) would
> be to reserve the first bit of the internal-format key to denote hashed vs.
> non-hashed.  OTOH then people would complain about losing one bit of strength,
> or someone would propose an attack based on knowing that the first bit will
> almost always be zero (for non-hashed), or something similar.  You can't win
> :-).
>
> Peter.
Okay, we're off on a tangent and into hypotheticals about what could be 
done, so I'll make two suggestions.  They could be used separately or 
together.

1.  The present scheme uses an OPAD of 3636...  .  Instead use 3636... 
when no hashing is done and, say, a9a9... when hashing is done.

2.  In addition to XORing the key with the OPAD, also XOR (at the right 
of the first block) with the length of the key in in bits (or bytes).

    --David Jacobson