Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I want to use hash function on some data, and part of this data, might be constant for a certain period. The output of the hash function is used as authentication data (MAC).

I want to know if there is:

  1. Reason to use/not use this data as input to the hash? (In the context of authenticity of data…)
  2. Impact on the "strength" of the hash function – can this constant help attacker to find out the source data of the hash function? (Help him do some smart brute force or something.)
share|improve this question
    
Is the "source data" the constant data or the non-constant data? $\;$ –  Ricky Demer Aug 3 at 17:18

1 Answer 1

up vote 3 down vote accepted

If you need a MAC, use a MAC. For example, HMAC which uses a hash function. Don't try to use a random hash function in your own scheme, because some such schemes are not secure.

Reason to use/not use this data as input to the hash? (In the context of authenticity of data…)

If you do have a secure MAC, any constant data will not affect the authenticity. Two different inputs will have completely different and unforgeable MACs even if they are known to differ in only e.g. one bit.

Impact on the "strength" of the hash function – can this constant help attacker to find out the source data of the hash function? (Help him do some smart brute force or something.)

Known constant data will not make it any weaker than if the data was not there. In the case of a hash function (not MAC) it could slightly improve a brute force search of two hashes if you knew they shared a long enough prefix... but as long as the data is unpredictable enough that shouldn't matter, and in the case of keyed MACs there is no such advantage.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.