# Tag Info

20

SHA-1 processes data by 512-bit blocks (64 bytes). For a given input message m, it first appends some bits (at least 65, at most 576) so that the total length is a multiple of 512. Let's call p the added bits (that's the padding). The padding bits depend only on the length of m (these bits include an encoding of that length, but they do not depend on the ...

9

You're missing the most important strength of HMAC: it comes with a proof of security (under some plausible assumptions). The outer key plays an important role in the proofs. The best place to learn more is to read the HMAC papers: Message authentication using hash functions: The HMAC construction, Mihir Bellare, Ran Canetti, Hugo Kawczyk, CryptoBytes ...

8

The short answer is no. I'll assume $SHA256_d(M)$ is $SHA256(M)$ when $d=0$, else $SHA256(SHA256_{d-1}(M))$. $SHA256_1$ is protected against length extension attacks. The only sizable benefit that I see in parameterizing $d$ is that it allows tuning a slow down of the computation intended as a protection against brute force attacks. However there are more ...

6

How does the length extension attack against $H(k||m)$ work? For Merkle-Damgård hashes, if you know $H(x)$ but not $x$ you can still choose an $e$ and then compute $H(x||p||e)$. With $x=k||m$ you can compute $H((k||m||p)||e)=H(k||(m||p||e))$ which is a valid authentication tag for $m||p||e$. Why doesn't it work against $H(m||k)$? With a length extension ...

5

As a Skein co-author, one of the properties of the UBI chaining mode is to give you HMAC-like properties in one pass. Skein itself consists of the Threefish tweakable block cipher, the UBI chaining mode, and some proofs that extend tweakable block cipher theory into a tweakable hash function theory that reduces the security of the hash function to the ...

5

The archetypal situation where the length-extension property becomes problematic is when ones builds a Message Authentication Code from a hash function as $$BadMAC(K,M)=Hash(K||M)$$ where $K||M$ is the concatenation of the Key and the Message. The length extension property then translates directly into the capability to forge a different message, starting ...

4

AFAIK the d stands for double, and simply means that the input gets hashed twice. i.e. SHA-256d = SHA-256(SHA-256(m)). It's not a configurable parameter, since hashing more often has no benefit, unless you want a slow down, but there are better constructions for that case. Hashing twice prevents length-extension attacks, but reduces performance, especially ...

4

The key to understanding hash extension attacks is to understand that the hash output isn't just the output of the machine generating the hash, it's also the state of the machine up till that point. In other words, just the hash output alone contains enough information for you to keep going and append more content to the hashed input. The catch is that ...

3

I'm putting another answer in because as good as D.W.'s answer is (I up-voted it), it doesn't really answer your question. You said: But the simple construction Hash(Hash(key|message)) would offer those properties too. But the construction you gave -- Hash(Hash(key|message)) -- has a weakness that HMAC does not. One of those properties was ...

2

To attack a MAC in general, the attacker needs to find a valid MAC of a message that they do not have the MAC for (or find a message collision that allows a different message to have the same MAC digest). In this case, the attacker would be appending data to the original message, not the MAC itself, and trying to obtain a valid MAC for the new message. In ...

2

First of all, let us explore what a "length extension attack" is; it might not be exactly what you assumed it was. Suppose we were given the MD5 hash of a bytestring we'll call $A$; we may have no idea what the string $A$ consists of, but we do know its length. Then, we can create a bytestring $B$ (which depends on the length of $A$, but not any of its ...

2

The short answer is: No, there is no known practical attack in the setup given. But we do not have an argument/proof that there is not one, and we should be less confident in that than we are in HMAC-MD5, for which we have such an argument.

Only top voted, non community-wiki answers of a minimum length are eligible