Re: [saag] attacks on keyed-hash constructions [was: Re: [cfrg] Further MD5 breaks: Creating a rogue CA certificate]

[RJ Atkinson <[e-mail]>]

On  5 Jan 2009, at 13:15, David McGrew wrote:
> I'm not sure what you mean by keyed-hash, but here are some attacks  
> that might be relevant.
>
> [1] B. Preneel and P. van Oorschot, “MD-x MAC and building fast MACs  
> from hash
> functions,” Advances in Cryptology – Crypto 95 Proceedings, Lecture  
> Notes in Computer
> Science Vol. 963, D. Coppersmith ed., Springer-Verlag, 1995.
>
> [2] B. Preneel and P. van Oorschot, “On the security of two MAC  
> algorithms,” Advances
> in Cryptology – Eurocrypt 96 Proceedings, Lecture Notes in Computer  
> Science Vol. ??,
> U. Maurer ed., Springer-Verlag, 1996.
>
> RFC 2385 uses the method broken in Section 4.2 of [1].
>
> HMAC seems to be secure given some reasonable assumptions about the  
> hash functions (namely, that the underlying hash has a compression  
> function that is a PRF - no collision resistance is required); see http://eprint.iacr.org/2006/043

Thank you very much.
Pointers to the literature are very helpful.

One followup question, if I might, as a non-mathematician here.

Does the community agree on whether MD5, SHA-0, SHA-1, and/or SHA-2
meet the assumptions required by the HMAC proofs (e.g. your mention
above that the hash "is a PRF -- no collision resistance is
required") ???

I do continue to think that an Informational RFC that surveys
the use of hash functions -- as used by IETF protocols -- citing
the literature (as above) and comparing hash functions and modes
would be most helpful.  While RFC-4270 was good as far as it went,
it did not fully explain what the results meant relative to the
modes and algorithms that IETF specifications use -- and of course
time moves on and that RFC is now 3 years old.  :-)

Thanks again,

Ran
[e-mail]


_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag