PGP digital signature vs SHA256 HMAC Comparison

Question

First let me admit that I am not a mathematician or a cryptographer. I am responsible for assisting in making a recommendation on a project that is consolidating payment processes within a company's internal network.

We have payment files which are being created by various applications; Several legacy applications are using PGP to digitally sign the payment files (sign only - no encryption. The hash algorithm is SHA1 and the digital signature algo is RSA 1024). Several newer applications are protecting the payment files using SHA256 HMAC (using a 256 bit random private key).

Regardless of whether we decide on public key cryptography (PGP) or secret key cryptography (HMAC), we will replace the keys periodically and feel reasonably assured that we can protect the private key and passphrase or the secret key for HMAC.

The question has been raised questioning the relative strength of SHA256 HMAC vs. PGP digital signature. We know that the PGP digital signature is appended to each payment file, and network admins and others can easily copy signed payment files (but they cannot get to the PGP keys folder nor the passphrase). Similarly, the SHA256 HMAC hashtag value and the original plaintext payment file can be accessed by admins, but not the secret key.

Given that in both sets of applications a potential adversary can get the original plaintext and the digital signature or HMAC Hashtag, which of these two scenarios would be least vulnerable to brute force or other attacks that attempt to derive the private or secret key? Based on current computing power, how long should we have reasonable assurance that either technology would be relatively secure?

Answer 1

PGP [1024-bit] digital signature vs SHA256 HMAC Comparison...

First, you can compare asymmetric and symmetric algorithms. A 1024-bit asymmetric key provides about 80-bits of security. A SHA256 HMAC provides about 128-bits of security. With all other things being equal, the HMAC is stronger.

Second, I believe PGP (or is it GnuPG) uses Lim-Lee primes and they don't provide the prime factorization. So you can't test that they are any good in practice.

Third, the random key used in the HMAC may not be random. And the random numbers used to generate the asymmetric keys might have problems too. Randomness is a lot like bugs. To borrow from Dykstra, you can test for the absence of randomness, but the presence of it.

Fourth, both systems sound like they might be subject to forgeries. So you might want to ensure surreptitious forwarding, replays and other tricks don't occur.

Fifth, ... (favorite threat here).

Also, storing the private key or the symmetric key is the Unattended Key Storage problem described by Gutmann in his book Engineering Security. Its a problem without a solution.

---

other attacks that attempt to derive the private or secret key?

OK, this is easier. The adversary will not attempt to break the crypto. They will go around it. They will go around it by breaking into the system, getting root, and then reading the key from the filesystem.

There are only two crypto attacks I am aware. First was the factoring of the TI Signing Key, and second was the Flame malware. The TI factoring occurred on a 512-bit asymmetric key; while the Flame malware took advantage of MD5 collisions on Microsoft CA certificate.

Breaking into the system is a much more cost effective attack. It will probably start by phishing one of the ladies in HR or Accounts Receivable. That's how it started with with a few high profile attacks, like RSA Data Securities and one of the other big ones, like Sony (IIRC).

---

Based on current computing power, how long should we have reasonable assurance that either technology would be relatively secure?

I think 80-bits of security is within reach of a few well funded adversaries. But out of reach of most others.

128-bit security will likely never be within reach of anyone.

Answer 2

Questions like these are hard to answer because who can predict what the future holds, right?

That said, there are some things I wanted to share.

Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can. _{From NSA surveillance: A guide to staying secure by Bruce Schneier}

and

Our conclusion is that the validity of the assumption is questionable and that generating keys in the real world for "multiple-secrets" cryptosystems such as RSA is significantly riskier than for "single-secret" ones such as ElGamal or (EC)DSA which are based on Diffie-Hellman. _{From Ron was wrong, Whit is right by Arjen Lenstra et al.}

and finally, an XKCD Comic

Definitely SHA1 + RSA-1024 is on the weak side. JP Aumasson had this to say on twitter today:

Is it right? Who knows, but you should definitely be using at least RSA-2048 with SHA256 if you go the PGP route.

My personal believe is that either option is going to be very strong, in which case, the attacker will not go after the crypto but something else. For example, social engineering someone with access to the secret key or private key + passphrase.

The nice thing about the PGP route is that you don't have to have the private key to validate the signature. Going the HMAC route, you would. So I might go the PGP route with a good (at least 2048 bit) DSA key.