Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? What is the attacker calculating?

share|improve this question
3  
The article on this subject is Kim, Biryukov, Preneel, and Hong's paper, On the Security of HMAC and NMAC Based on HAVAL, MD4, MD5, SHA-0 and SHA-1. –  David Schwartz Apr 12 '12 at 9:25
add comment

1 Answer

up vote 14 down vote accepted

Actually, HMAC might still be secure for a hash function that is broken (with respect to the requirements of a cryptographic hash function, such as primary preimage resistance, secondary preimage resistance and collision resistance), but it must not be too badly broken. If you read the original paper, you see that the authors assume things such as the hash function being "weakly collision resistant", or more precisely that the inner hash function is collision resistant only to adversaries that see the hash value only after it being hashed again with a different secret key.

Also, since HMAC, contrary to NMAC, doesn't use two independent keys, but a single key that is combined with two different pads using XOR, additional assumption about the pseudo randomness of the hash function are made.

I believe MD4 does not even meet these weaker assumptions, and that is why HMAC-MD4 is considered to be broken, while e.g. HMAC-MD5 is not (yet).

share|improve this answer
1  
That said, new implementations should probably default to something like HMAC-SHA2 out of an abundance of caution. –  Stephen Touset Apr 9 '13 at 22:56
2  
It may be worth noting that the security argument for HMAC has been improved with a refined argument asking for somewhat weaker properties than in the original proof. –  fgrieu Apr 11 '13 at 5:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.