Timeline for Why are collision attacks important when talking about MAC schemes?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 13, 2017 at 12:48 | history | edited | CommunityBot |
replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/
|
|
| Jan 24, 2016 at 22:43 | vote | accept | ithisa | ||
| Apr 12, 2014 at 21:59 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
deleted 4 characters in body
|
| Apr 12, 2014 at 21:57 | comment | added | fgrieu♦ | @user54609: 64-bit security against brute force key search is kinda ridiculous nowadays, but a 64-bit MAC is still very strong when the only way to check if it is right or wrong is try on the actual target and that takes 1 microsecond (that figure is unrealistically low even for a direct 10 Gbps Ethernet link): odds of success are worse than 1/500000 per year of continuous attack. Also, it is easy to detect such attacks. | |
| Apr 12, 2014 at 21:46 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Polish
|
| Apr 12, 2014 at 21:41 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Polish
|
| Apr 12, 2014 at 21:35 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
State that HMAC is affected, but some truncated MACs are not.
|
| Apr 12, 2014 at 21:28 | comment | added | ithisa | 64-bit security is kinda ridiculous nowadays though. Why aren't we seeing brute-force forgery attacks on SSH, which uses HMAC-MD5, for example? Does this imply all those AES-256-GCM things are totally pointless since they could after all be using a 64-bit key? | |
| Apr 12, 2014 at 21:17 | comment | added | fgrieu♦ | @user54609: Yes, this attack works against HMAC with a hash using a 128-bit state, and e.g. allows a forgery of HMAC-MD5 in about $2^{64}$ queries. It does not contradict the fact that HMAC-MD5 remains practically unbroken as far as we know, when MD5 is not secure against collision, as supported by that security argument. | |
| Apr 12, 2014 at 21:01 | comment | added | ithisa | Does this attack work for HMAC? I seem to recall that HMAC is secure even when the underlying hashing function is vulnerable to collision attacks much faster than birthday (i.e. MD5). | |
| Apr 12, 2014 at 18:39 | comment | added | DrLecter | @fgrieu ah, ok :) | |
| Apr 12, 2014 at 18:37 | comment | added | fgrieu♦ | @DrLecter: That was not stated again in my last paragraph (now fixed). And it is worth noting. | |
| Apr 12, 2014 at 18:36 | comment | added | DrLecter | @poncho true, but fgrieu says that he talks about deterministic MACs. | |
| Apr 12, 2014 at 18:32 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Detail "deterministic" and state that in the end, per comment
|
| Apr 12, 2014 at 18:25 | comment | added | poncho | I would like to point out that this arguments doesn't work when you start talking about MACs with nonces; in that case, if you model the nonce as a part of the state, then the probability of an internal collision between two different messages may be 0, because the two messages will always have different nonces. | |
| Apr 12, 2014 at 17:41 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Improve per comment
|
| Apr 12, 2014 at 17:14 | comment | added | DrLecter | you may want to add some short statement about iterated-MAC constructions at the beginning to fully answer the OP's question and to underpin why the birthday happens to be of interest. | |
| Apr 12, 2014 at 16:59 | history | answered | fgrieu♦ | CC BY-SA 3.0 |