Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

HMAC does nested hashing in order to prevent Length Extension Attacks.

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC?

Needless to say we'd still use a key, which we prepend or append to the message, but is that sufficient for a MAC?

share|improve this question
2  
Use the key as prefix not as suffix. Key as suffix is secure as well as long as SHA-3 remains unbroken, but falls once a collision attack is found. If you don't care about the performance cost, still using HMAC is a good choice as well. –  CodesInChaos Jun 17 at 10:44
2  
This question is pretty similar to Can Skein be used as a secure MAC in format H(k || m)? –  CodesInChaos Jun 17 at 10:44
1  
@CodesInChaos, that post seems to assume a Merkle–Damgård construction, whereas SHA-3/Keccak uses the sponge construction. Does it still apply? –  otus Jun 17 at 11:48
1  
This question is arguably closer, but not really a duplicate (I retracted my vote) because it asks whether HMAC-SHA3 is provably secure rather than whether there are smaller schemes that work. Have a look at the dedicated Keccak MAC functions (for example as part of their AE schemes), including the Keyed Sponge functions. –  figlesquidge Jun 17 at 11:56
    
@figlesquidge Security is a relative notion. The question you link to in your comment, as well as the accepted answer to that question, explains in detail to what extent HMAC-SHA3 would be more secure than using in SHA3 in its built in MAC mode. –  Henrick Hellström Jun 17 at 12:52

1 Answer 1

up vote 4 down vote accepted

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC?

No, you don't need to do that, but you can.

Needless to say we'd still use a key, which we prepend or append to the message, but is that sufficient for a MAC?

Yes, you can prepend the message with the key, i.e. use $H(K||M)$.

Quoting the Keccak (SHA3) website:

Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key.

However, the draft standard does not specify this MAC mode, only a hash function. So using HMAC-SHA-3 would be the more conservative choice if you wanted to use only standardized primitives (after the draft is finalized).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.