# Is it safe to salt a MAC?

Say that I define a scheme where the salt is public and is MAC-ed with the message:

$k = KDF(password, salt)$
$tag = MAC_k(salt || message)$

Is it safe to salt the MAC this way? Assume that the salt is public and can be modified by an attacker.

• I’m probably missing something… why would you want to salt the output of a key derivation function?Superfluous” is the word that comes to mind, since salting the output of a KDF won’t gain any randomness, nor cryptographic security. What’s the exact scenario (or cryptographic problem) you’re trying to solve? What exactly are you trying to achieve with your … salt MAC's key, which is derived with KDF? – e-sushi Oct 26 '14 at 9:48
• @e-sushi I don't want to salt output of KDF. I want to salt password with KDF and use that key in MAC. I have corrected question. – LightBit Oct 26 '14 at 10:05
• If an IV is used for an underlying block cipher mode then it makes sense to MAC the IV along with the ciphertext. I agree with Travis that MAC'ing the salt doesn't seem to add any security. – Maarten Bodewes Oct 26 '14 at 13:15
• @owlstead I would like to use same (split in two halves) slow KDF for encryption (CTR) and MAC (XCBC). Instead of using nonce in CTR I would use salt when deriving key. Does this make any sense? – LightBit Oct 26 '14 at 13:46
• No, it doesn't. You may as well use a zero nonce. If, as you suggest, the salt changes for each encryption then the key changes for each encryption. If that's true, even a zero IV is already unique for the key. If the salt doesn't change, then the salt is not unique for the generated key as the same key is derived from the same salt and password. – Maarten Bodewes Oct 26 '14 at 13:49

## 2 Answers

As Trevis says, it's at least as safe: there's a simple reduction from the salted to the non-salted MAC, assuming the latter is secure in the standard "existential unforgeability under chosen message attacks".

Assuming the adversary has full control of the salt, it also won't buy you anything security wise. In a slightly different setting, where the salt for the MAC is chosen at random and fresh for every message (but is public), salting can slightly improve security for some particular MACs, cf. "Improving the Security of MACs via Randomized Message Preprocessing" http://www.cs.nyu.edu/~dodis/ps/exact-macs.pdf

Safe, yes, but it doesn't really give you anything. The only use for a salt is to mitigate precomputation attacks against a password. Since it is public, it gives you no extra MAC security. By the property of the MAC, no adversary can forge one without knowing the key, and by the security of your KDF (which includes the salt) no one should be able to get the key. So, it is pretty much pointless.

• I'm asking, because I know adding IV to CBC-MAC is a bad idea. I do not expect to make MAC any stronger. Salt is for encryption part (see my comment up). – LightBit Oct 26 '14 at 13:49
• You shouldn't be using CBC-MAC at all. Use the derived CMAC algorithm instead. – Maarten Bodewes Oct 26 '14 at 13:51
• @owlstead As far as I know this applies to CMAC as well. – LightBit Oct 26 '14 at 13:59
• I don't think this is a problem when you use two separate keys and encrypt-than-MAC. If unsure, rely on HMAC instead. – Maarten Bodewes Oct 26 '14 at 14:50