11
$\begingroup$

Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course.

When using Hash-based message authentication codes, I understand that you need to protect the front and back of the MAC to prevent an adversary from modifying the HMAC while in transit.

HMAC (K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m))

As such, a HMAC is constructed by hashing the XOR of the secret key K with the outer padding opad concatentated with the hash of the secret key K XORed with the inner padding ipad concatenated with the message.

Can someone explain how these “secret keys XORed with padding” protect the HMAC from modification by an adversary (such as appending data to the end of the MAC)?

$\endgroup$
  • $\begingroup$ An HMAC has a fixed length. Appending data to it would make it trivially invalid. $\endgroup$ – Stephen Touset Jan 1 '14 at 21:51
  • 3
    $\begingroup$ @StephenTouset, by "appending data to the end", I think George is referring to a length extension attack, which is not trivial. $\endgroup$ – David Cary Jan 2 '14 at 1:45
7
$\begingroup$

To attack a MAC in general, the attacker needs to find a valid MAC of a message that they do not have the MAC for (or find a message collision that allows a different message to have the same MAC digest). In this case, the attacker would be appending data to the original message, not the MAC itself, and trying to obtain a valid MAC for the new message. In specific, it sounds like you are thinking of length-extension attacks.

In HMAC, the inner hash by itself would be vulnerable to a length-extension attack and the attacker could successfully calculate a valid inner hash digest without access to the key. However, the outer hash isn't vulnerable to a length-extension attack since the client performing the HMAC authentication is only going to input the fixed length string key || inner_hash into it. The attacker only controls variable-length input to the inner hash, not the outer hash.

This is more-or-less addressed by this answer to another question. Relevant excerpt:

the role of the inner function is to provide collision-resistance (to compress a long message down to a short fingerprint, in a way so that someone who does not know the key cannot find a pair of messages with the same fingerprint), and the role of the outer function is to act as a message authentication code on this fingerprint.

$\endgroup$
  • $\begingroup$ To extend your answer to an unanswered part of the question, the particular values for ipad and opad aren't critically important. The security proof for HMAC only requires the inner key and outer key to be different by at least one bit. The values for ipad and opad have a large hamming distance, ensuring that a high number of bits are different. This is (AFAIK) simply an attempt to be as conservatively defensive as possible. $\endgroup$ – Stephen Touset Jan 2 '14 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy