Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The standard HMAC function, $H(K, m)$, authenticates a single message $m$.
Instead, I'd like to authenticate 2 messages, like this: $$H'(K, m_1, m_2)$$
The simplest solution, $H(K, m_1||m_2)$, confuses e.g. "ab"+"cd" or "abc"+"d" as messages.
Would this be secure instead: $H(H(K, m_1), m_2)$?
Yes. $\:$ However, note that also using $K$ in the ordinary way would be a huge vulnerability, since
learning $H(K,m_1)$ would allow anyone to authenticate $m_1$ together with arbitrary messages $m_2$.
The two solutions $H(K,$prefixfree$\hspace{.02 in}(m_1)\hspace{.02 in}||\hspace{.02 in}m_2)$ and
if $\: \operatorname{length}(m_2) < \operatorname{length}(m_1\hspace{-0.02 in}) \:$ then $H(K,1\hspace{.02 in}||\hspace{.02 in}$prefixfree$\hspace{.02 in}(m_2)\hspace{.02 in}||\hspace{.02 in}m_1)$ else $H(K,0\hspace{.02 in}||\hspace{.02 in}$prefixfree$\hspace{.02 in}(m_1)\hspace{.02 in}||\hspace{.02 in}m_2\hspace{.02 in})$
are probably faster. $\:$ (For either of those, also using $K$ in the ordinary way
would merely let an adversary authenticate specific extra messages.)
If the hashing function $H$ is secure, then $H(H(K, m_1), m_2)$ is secure. But at the cost of applying $H$ twice.
