Re: [CFRG] Reference for weakness in MAC=hash(key|msg) construct

At the very least, MAC=H(key || msg) suffers from length extension attacks.

At the very least, use envelope method - see https://people.scs.carleton.ca/~paulv/papers/Euro96-2MACs.pdf and https://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=5367681D1DA5BDA44A5247EEA2DB7AD2?doi=10.1.1.490.8595&rep=rep1&type=pdf 

Also, you may want to look at NMAC-related papers.
https://link.springer.com/chapter/10.1007/11818175_36 aka https://eprint.iacr.org/2006/043.pdf 

Having said all that - it appears that SHA-3 would *not* suffer from those vulnerabilities. As a precaution, the key must be padded to the complete block size.

TNX
-- 
V/R,
Uri

On 5/13/22, 10:24, "CFRG on behalf of Robert Moskowitz" <cfrg-bounces@irtf.org on behalf of rgm-sec@htt-consult.com> wrote:

    I need to show that a MAC based on hash(key|msg) is bad and this has 
    been known since the mid-90s.

    This is for the Drone Command and Control (C2) open protocol MAVlink's 6 
    byte authentication:

    https://mavlink.io/en/guide/message_signing.html

    I am familiar with "Keying hash functions for message authentication 
    (1996)" by Mihir Bellare , Ran Canetti , Hugo Krawczyk, but it does not 
    clearly show the weakness of hash (key|msg). 
    (https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.134.8430)

    I attended Hugo's presentations of HMAC and SIGMA at the ISOC Security 
    Conference in '96 and have been using them since.  But now I encounter, 
    and have to deal with what I believe is a flawed design.  I need to show 
    references that this was known flawed for 20 years prior to MAVlink 2.0 
    (that added the auth).

    Well, anyway, what I learned 25 years ago set my mind that 
    MAC=hash(key|msg) construct is flawed.  Details tend to get hazy over time.

    Note that MAVlink may be transported over UDP on port 14550.  By using 
    RFC8750 (and a 12-byte ICV for GCM) and draft-mglt-ipsecme-diet-esp I 
    can have ESP/AES-GCM-12/UDP in 16 bytes.  Compress the MAVlink Seq, 
    Checksum, and Sig out, replacing them with this design in the same 
    length (and include the 8 byte UDP cost).

    So anyway, the basic need is a reference on the weakness of 
    MAC=hash(key|msg) construct

    thanks.

    _______________________________________________
    CFRG mailing list
    CFRG@irtf.org
    https://www.irtf.org/mailman/listinfo/cfrg

Re: [CFRG] Reference for weakness in MAC=hash(key|msg) construct

Attachment: smime.p7s