2
$\begingroup$

When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used), should we use SHA-256 or SHA-512? This answer seems to indicate SHA512. Is this interpretation correct? I've seen an implementation using SHA256 and cannot figure out, why.

Edit: Since it does not seem to be entirely clear: I'm talking about an algorithm using HMAC-SHA for authentification and Aes256 for encryption ("Encrypt-then-MAC") in order to provide authenticated encryption.

Improve this question
$\endgroup$
2
  • $\begingroup$ Consider also that there's a recommendation (that I don't know the justification for) that: "the minimal recommended length for K is L bytes (as the hash output length)." (source: rfc-editor.org/rfc/rfc2104). So assuming this guideline is followed, using SHA256 allows you to use the smallest key size among the SHA-2 family of functions $\endgroup$
    – Amit
    May 6 at 19:29
  • $\begingroup$ @Amit That realistically doesn't matter in the case of HMAC-SHA-512. A 256-bit key is absolutely fine and still provides 256-bit security. $\endgroup$
    – samuel-lucas6
    May 7 at 7:48

1 Answer 1

Reset to default
4
$\begingroup$

That pairing is considering security against the most vulnerable aspect - collision resistance of hash functions.

However, when used in SSL/TLS, hash function is most likely used for key derivation or MAC, in which case, pre-image resistance should be considered. Therefore, SHA-256 is fine here.

Improve this answer
$\endgroup$
7
  • 1
    $\begingroup$ Collision resistance does matter if you want your scheme to be key or fully committing (committing to the key, nonce, associated data, and message), which prevents attacks in malicious sender type scenarios. For example, HMAC-SHA-1 and HMAC-SHA-256 truncated down to 128 bits are inappropriate for this. $\endgroup$
    – samuel-lucas6
    May 6 at 7:36
  • 2
    $\begingroup$ On 64-bit platforms, SHA-512 is often preferable to SHA-256 for better efficiency. $\endgroup$
    – fgrieu ♦
    May 6 at 12:50
  • 2
    $\begingroup$ @fgrieu I think that depends. GPR-only implementations of SHA-512 is definitely better than that of SHA-256, but such advantage may not be as significant when using vector instructions. And for the specific case of x86, SHA-256 is available natively, in low-end Intel and newer AMD chips, whereas SHA-512 is simply absent in x86. $\endgroup$
    – DannyNiu
    May 6 at 16:26
  • $\begingroup$ Does that mean the answer linked in the question is wrong in making that pairing based on collision resistance when only weak collision resistance (security.stackexchange.com/a/187868) is required for HMAC? [By the way, I upvoted your answer because it has already helped me. But I need to do some further research before I can accept it] $\endgroup$
    – SeekingAnswers
    May 7 at 6:19
  • 1
    $\begingroup$ @SeekingAnswers If you want to claim 256-bit committing security, you'd need to use the full output of HMAC-SHA-512. Of course, nobody needs 256-bit committing security; 128-bit security is fine. Some papers also discuss a 160-bit tag to reduce storage overhead, but you may as well use 256 bits. Lower than 160-bit is not sensible. If you're doing Encrypt-then-MAC, there's no reason you shouldn't be aiming for the scheme to be committing. It's an advantage generic composition has over the current standardised AEADs. $\endgroup$
    – samuel-lucas6
    May 7 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.