For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? What is the attacker calculating?
$\begingroup$
$\endgroup$
1
-
4$\begingroup$ The article on this subject is Kim, Biryukov, Preneel, and Hong's paper, On the Security of HMAC and NMAC Based on HAVAL, MD4, MD5, SHA-0 and SHA-1. $\endgroup$– David SchwartzCommented Apr 12, 2012 at 9:25
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
Actually, HMAC might still be secure for a hash function that is broken (with respect to the requirements of a cryptographic hash function, such as primary preimage resistance, secondary preimage resistance and collision resistance), but it must not be too badly broken. If you read the original paper, you see that the authors assume things such as the hash function being "weakly collision resistant", or more precisely that the inner hash function is collision resistant only to adversaries that see the hash value only after it being hashed again with a different secret key.
Also, since HMAC, contrary to NMAC, doesn't use two independent keys, but a single key that is combined with two different pads using XOR, additional assumption about the pseudo randomness of the hash function are made.
I believe MD4 does not even meet these weaker assumptions, and that is why HMAC-MD4 is considered to be broken, while e.g. HMAC-MD5 is not (yet).
answered Apr 10, 2012 at 8:04
-
2$\begingroup$ That said, new implementations should probably default to something like HMAC-SHA2 out of an abundance of caution. $\endgroup$ Commented Apr 9, 2013 at 22:56
-
3$\begingroup$ It may be worth noting that the security argument for HMAC has been improved with a refined argument asking for somewhat weaker properties than in the original proof. $\endgroup$– fgrieu ♦Commented Apr 11, 2013 at 5:45
-
1$\begingroup$ According to di.ens.fr/~fouque/pub/crypto07b.pdf, HMAC-MD4 is technically broken, but it requires $2^{88}$ MAC queries and $2^{95}$ MD4 operations. I think a paper a year later improved on that a bit. $\endgroup$– forestCommented Jul 28, 2019 at 9:34