Does SHA384 make sense with HMAC-SHA256?

Question

In the sense of security level (as defined, for example, by Ferguson and Schneier in the book Practical Cryptography), does it make sense to use SHA384 with HMAC-SHA256 in the general settings. By birthday paradox, HMAC-SHA256 will give a security level of 128 bits, and SHA384 will give 192 bits. To my understanding, the overall security level will be limited to 128 bits and SHA384 is just faking around.

More specific settings: Transmitted packet is:

(x,y,z)

where

y = SHA384 (w)     
z = HMAC-SHA256(x||y)
x and w are any arbitrary values

Ferguson and Schneier also state that SHA384 is relatively useless (as in we do all the work SHA512 and then throw away the bits). Is it still valid for all possible implementations of SHA384?

Answer 1

A keyed hash is not susceptible to collisions / the birthday paradox as the attacker doesn't have the key; you cannot do any pre-calculation and create a set of known hashes because of that (well, you could if you'd have an Oracle with the key, but in that case the Oracle would be signing random data delivered to it).

So you underestimate the security offered by HMAC; in most cases it offers security that is approximately the same as the output size / size of the key. See also keylength.com / NIST recommendations for instance (you need to look at "Hash (B)" for HMAC in the table).

---

However, you are using y = SHA384(w). Now if an attacker can try and create collision for specific values of w, which would mean that the hash collision is used within the HMAC input, which will of course result in the same HMAC value as well. So here the birthday bound does apply.

So yes, in this case you could try and use SHA-384 or SHA-512 (as length extension attacks won't result in a collision, so those are not on topic). SHA-384 could be used if you suspect that another block of hashing is required if SHA-512 is used though; SHA-384 may then be slightly more efficient - if such efficiency is required at all.

However, please note that we generally assume that SHA-256 already has a strength of 128 bits even when assuming birthday attacks, so there is still no pressing need to use SHA-384 even then.