Re: [CFRG] Reference for weakness in MAC=hash(key|msg) construct

The Wikipedia article on length extension attacks has some links on why
H(key|message) is bad if H is length-extensible (e.g., SHA-1, SHA-256).

https://en.wikipedia.org/wiki/Length_extension_attack

On Fri, May 13, 2022 at 10:25 AM Robert Moskowitz <rgm-sec@htt-consult.com>
wrote:

>
> I need to show that a MAC based on hash(key|msg) is bad and this has
> been known since the mid-90s.
>
> This is for the Drone Command and Control (C2) open protocol MAVlink's 6
> byte authentication:
>
> https://mavlink.io/en/guide/message_signing.html
>
> I am familiar with "Keying hash functions for message authentication
> (1996)" by Mihir Bellare , Ran Canetti , Hugo Krawczyk, but it does not
> clearly show the weakness of hash (key|msg).
> (https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.134.8430)
>
> I attended Hugo's presentations of HMAC and SIGMA at the ISOC Security
> Conference in '96 and have been using them since.  But now I encounter,
> and have to deal with what I believe is a flawed design.  I need to show
> references that this was known flawed for 20 years prior to MAVlink 2.0
> (that added the auth).
>
> Well, anyway, what I learned 25 years ago set my mind that
> MAC=hash(key|msg) construct is flawed.  Details tend to get hazy over time.
>
> Note that MAVlink may be transported over UDP on port 14550.  By using
> RFC8750 (and a 12-byte ICV for GCM) and draft-mglt-ipsecme-diet-esp I
> can have ESP/AES-GCM-12/UDP in 16 bytes.  Compress the MAVlink Seq,
> Checksum, and Sig out, replacing them with this design in the same
> length (and include the 8 byte UDP cost).
>
> So anyway, the basic need is a reference on the weakness of
> MAC=hash(key|msg) construct
>
> thanks.
>
>
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>