Timeline for Secret IV MAC with weak hash function
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 25, 2017 at 15:32 | vote | accept | firefexx | ||
| May 16, 2017 at 14:31 | history | tweeted | twitter.com/StackCrypto/status/864488570949705729 | ||
| May 16, 2017 at 4:16 | answer | added | Richard Thiessen | timeline score: 4 | |
| May 16, 2017 at 0:38 | history | edited | e-sushi | CC BY-SA 3.0 |
edited body
|
| Nov 26, 2016 at 9:44 | comment | added | firefexx | Yes, I really mean using a secret-IV. So in practical use, an implementation of $H$ is modified to allow the initialization of the IV/state variables (i.e. 128 bit in case of MD4) before the message is hashed. I know, this is not the usual way and one reason I ask this. For secret-prefix MAC constructions, more attacks are documented in publications. | |
| Nov 25, 2016 at 15:20 | comment | added | Ilmari Karonen | By $H_k(m)$, do you really mean modifying $H$ to use $k$ as the IV in the Merkle-Damgård costruction, or do you just mean prepending $k$ (possibly padded to a whole block) to the message $m$ before feeding it to $H$? In terms of security, there's not a lot of difference as long as $k$ is chosen randomly anyway, but IME the latter construction is a lot more common (e.g. it's what HMAC does internally) simply because many hash function APIs don't directly expose the IV. | |
| Nov 24, 2016 at 15:52 | history | asked | firefexx | CC BY-SA 3.0 |