Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is there any reason to prefer one over an other? In practice HMAC seems to be much more widely used, is that a result of cryptographic, or social reasons?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
HMAC was there first (the RFC 2104 is from 1997, while CMAC is from 2006), which is reason enough to explain its primacy. If you use HMAC, you will more easily find test vectors and implementations against which to test, and with which to interoperate, which again explains continued primacy. Being the de facto standard is a very strong position.
On many embedded systems, one may expect HMAC to be faster than CMAC, because hash functions are usually faster than block ciphers. This is not true if the platform includes some hardware optimization for a specific block cipher (e.g. dedicated AES opcodes), or if the messages are short (HMAC has the same asymptotic cost as hashing, but also a fixed overhead), or if you do something stupid like selecting a slow hash function as a basis for HMAC (e.g. Whirlpool). As with all performance things, actual measures are needed to reach any kind of definitive conclusion.
If you need to both encrypt and MAC, then the smart thing to do is not HMAC or CMAC, but rather to use an authenticated encryption mode which will do both properly, simultaneously, and at a lower cost (or at least so it is hoped). Usual candidates are EAX and GCM. The CAESAR competition was held to find new, better AE (Authenticated Encryption) ciphers.
answered Apr 22, 2014 at 14:37
-
$\begingroup$ Hashes usually faster than block ciphers sounds weird. After all most hashes are built from block ciphers and have stronger requirements than PRPness. Could be a historical accident since hashes are commonly ARX based, which is efficiently implementable in software, but that's no inherent property of hashes. $\endgroup$ Apr 22, 2014 at 18:57
-
$\begingroup$ Beware: MD hash functions like SHA-1 are built out of a block cipher, but with the data as key, which apparently allows for better bandwidth. At least we can empirically notice that the SHA-3 competition yielded algorithms which are quite faster than all AES candidates on the same hardware. Even AES-based SHA-3 candidates (e.g. ECHO) turned out to be quite faster than AES itself on the same machine. $\endgroup$ Apr 22, 2014 at 19:08