[OPSEC] 2006 Paper on HMAC MD5/SHA attacks

> http://eprint.iacr.org/2006/319.pdf

Rich Graveman shared the above URL with me just now.
I encourage everyone to read the original document.
This is the extended version of a paper that appeared
in Asiacrypt 2006.[1]

The abstract from the paper reads:
	In this paper we analyze the security of HMAC and NMAC,
	both of which are hash-based message authentication codes.
	We present distinguishing, forgery, and partial key
	recovery attacks on HMAC and NMAC using collisions
	of MD4, MD5, SHA-0, and reduced SHA-1.  Our results
	demonstrate that the strength of a cryptographic
	scheme can be greatly weakened by the insecurity of
	the underlying hash function.

Note that as this paper is a refereed research paper,
it uses terms more precisely than the IETF sometimes
does.  In particular, the word "attack" has a precise
meaning that a function has less cryptographic strength
than previously expected, not that the function has
zero strength.

For example, please see Table 1, which characterises
the work required, O(number of compute operations),
to execute a particular kind of attack for a particular
construction and hash function.

Please also see Section 1.4 of the paper, which says
in part:
   The attacks presented in this paper do not imply any
   immediate practical threat to implementations of HMAC-MD5
   or HMAC-SHA1.  However, our attacks on HMAC-MD4 may not
   be out of range of some adversaries, and therefore it
   should no longer be used in practice.

Kindly note that the paper does not analyse the Keyed-Hash
mode of operation for any algorithm.

I am continuing to scout the published literature
to see what else might be relevant.  As I find other
papers, I'll try to share either URLs or formal citations
for them here.

Cheers,

Ran
rja@extremenetworks.com

[1] http://eprint.iacr.org/2006/319

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec