Given: an AES-128 secret key (ASecKey) encrypts a file (CBC mode). (Assume good random)
Is is insecure to append (include) an HMAC-SHA1 of ASecKey to file?
Purpose: The receiver can then quickly verify if the shared secret key was used to encrypt.
3
-
3$\begingroup$ What key is used to compute the HMAC? $\endgroup$ – yyyyyyy Jun 28 '15 at 21:29
-
$\begingroup$ Same key. That is: ASecKey encrypts file and ASecKey is used to compute HMAC $\endgroup$ – cary melz Jun 29 '15 at 14:14
-
$\begingroup$ ASecKey is used to compute HMAC of what? I.e. what are the key and message to HMAC? $\endgroup$ – otus Jun 30 '15 at 14:00
Add a comment
|
$\begingroup$
$\endgroup$
4
It's probably better to use a KBKDF as that doesn't need a key as input. You can use the KDF as key check value or KCV. If you use a block cipher based KBKDF from NIST SP 800-108 then you could reuse the AES algorithm to calculate the KCV.
You could however also make it easy for yourself and use a SHA-1 or SHA-2 over the key as KCV.
Note that the PKCS#11 method allows for calculating a KCV by encrypting a block of all zero's; this method should not be used.
answered Jun 28 '15 at 23:57
-
$\begingroup$ Please note my question here though. $\endgroup$ – Maarten Bodewes♦ Jun 28 '15 at 23:58
-
$\begingroup$ Thank you Marten. I don't understand why it's better to use a KBKDF that doesn't use a key $\endgroup$ – cary melz Jul 6 '15 at 18:47
-
$\begingroup$ Well, you say that you want to use HMAC, but in that case you would require a key and data. Now you could use the key and pre defined data, but that's a bit of a kludge. With a KDF you could just use the key as seed. $\endgroup$ – Maarten Bodewes♦ Jul 6 '15 at 20:06
-
$\begingroup$ So HMAC (key, data) where key=data is not insecure, it's just not needed. SHAing the key does not imply loss of any pre -Image resistance. Thank you, again. $\endgroup$ – cary melz Jul 6 '15 at 20:50
$\begingroup$
$\endgroup$
To setup HMAC, you need a key. This key should be derived from ASecKey, for example by using HKDF. As input for HKDF, you supply Salt (does not have to be secret) + ASecKey. Then you generate entropy with HKDF (e.g. extract PRK and expand it). Use this entropy to obtain HMAC key. Then you can attach HMAC output to your file. When receiver wants to decrypt file, she supplies ASecKey, which is used to decrypt message and initialize HMAC. Without ASecKey, an attacker can't determine what key is used for HMAC. With HMAC, you can verify integrity of the encrypted message (you should encrypt, then HMAC). If you want to check whether supplied ASecKey is correct, you can use some of the HKDF output I described before as password validator sequence, which you attach to the file and check on decryption.
