Re: [saag] [Cfrg] attacks on keyed-hash constructions [was: Re: [cfrg] Further MD5 breaks: Creating a rogue CA certificate]

[Christian Rechberger <[e-mail]>]

Quoting RJ Atkinson <[e-mail]>:

>
>> HMAC seems to be secure given some reasonable assumptions about the  
>> hash functions (namely, that the underlying hash has a compression  
>> function that is a PRF - no collision resistance is required); see  
>> http://eprint.iacr.org/2006/043
>
> Thank you very much.
> Pointers to the literature are very helpful.
>
> One followup question, if I might, as a non-mathematician here.
>
> Does the community agree on whether MD5, SHA-0, SHA-1, and/or SHA-2
> meet the assumptions required by the HMAC proofs (e.g. your mention
> above that the hash "is a PRF -- no collision resistance is
> required") ???

That seems a very valid question, and indeed cryptographers have been  
working on  PRF properties, and violations of it can be used to  
construct attacks on HMAC.

As opposed to unkeyed modes, none of the attacks which have been  
developed in recent years on HMAC (when instantiated with one of the  
popular hash functions) are practical.

Still, there are attacks on HMAC-MD4 (see e.g. [1]), NMAC-MD5 (see  
e.g. [1,2]). For HMAC-SHA-1, the best result is on reduced variants  
(61/62 out of its 80 steps, see [2]).

To conclude, from a cryptanalyst point of view:
HMAC-MD4: please don't, attacks might become practical anytime
HMAC-MD5: only certificational attacks, nothing real or serious, but  
MD5 just does not look like a good PRF
HMAC-SHA-1: ok, some security margin left
HMAC-SHA-2: no concrete cryptanalytic results, most likely ok.


hth,
  Christian



[1]  Pierre-Alain Fouque, Gaëtan Leurent, Phong Nguyen: Full  
Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5, CRYPTO 2007.

[2] Christian Rechberger and Vincent Rijmen: On Authentication with  
HMAC and Non-Random Properties, Financial Cryptography 2007.


-- 
Christian Rechberger <[e-mail]>
Krypto Group - IAIK - TU Graz, Inffeldgasse 16a, A-8010 Graz, Austria
http://www.iaik.tugraz.at/content/research/krypto/
phone: [phone]  ---  fax: [phone]

_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag