11
$\begingroup$

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc).

However, Carter-Wegman MAC variants are not very popular on the internet like HMAC. Why is this so? Do Carter-Wegman MAC variants have some disadvantage that prevents them from being widespread?

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ AES-GCM is becoming pretty common. Salsa20/ChaChaPoly1305 are are used occasionally as well. $\endgroup$
    – CodesInChaos
    Aug 20, 2014 at 10:51
  • 1
    $\begingroup$ WC style MACs need a nonce and leak the key if you ever reuse one. $\endgroup$
    – CodesInChaos
    Aug 20, 2014 at 10:52
  • 2
    $\begingroup$ @CodesInChaos: some CW MACs are more tolerant about nonce reuse. It all depends on the crypto part that takes the output of the universal hash, and disguises it. Earlier CW MACs did a hash over the universal hash and the nonce; nonce reuse would tell the attacker little (unless the universal hash output was also the same -- a low probability event by the definition of universal hash). Modern CW MACs tend to use the universal hash output xor'ed with an encrypted form of the nonce -- that's a lot dicier with nonce reuse. $\endgroup$
    – poncho
    Aug 20, 2014 at 19:06

1 Answer 1

Reset to default
10
$\begingroup$

A lot has changed recently in this area. Now the only ciphersuites Chrome considers non-obsolete (those that use AES-GCM or ChaCha+Poly1305), do use Carter-Wegman MACs.

So, I would say that there is no disadvantage and that any low popularity has been just an artifact of historical decisions in standardization. Secure hashes were the first to be openly standardized and exportable, so they were used for MACs as well.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Unlike AES-GCM, ChaCha+Poly1305 does not use a Carter–Wegman MAC: rather than reusing a single hash key for multiple messages in the way that Carter and Wegman proposed, there is a fresh hash key chosen for each message. $\endgroup$
    – Squeamish Ossifrage
    Mar 7, 2019 at 20:00
  • 1
    $\begingroup$ @SqueamishOssifrage, it's mostly a matter of semantics, but call it a Carter–Wegman style MAC if you must. Poly1305 itself would reuse the hash key, it's just a consequence of the higher level algorithm that it does not get reused in ChaCha-Poly1305. $\endgroup$
    – otus
    Mar 8, 2019 at 6:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.