7
$\begingroup$

The original HMAC algorithm is as follows:

H(K XOR opad || H(K XOR ipad || text))

What if text would replaced with H(text)? Will it weaken the HMAC algorithm?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
9
$\begingroup$

What if text would replaced with H(text)? Will it weaken the HMAC algorithm?

Yes. It makes collision attacks on the hash function apply to the MAC, which isn't normally the case with HMAC. You can find a pair $(m, m')$ that hash to the same value, get the MAC for one of them and move it to the other.

That means that your modified HMAC construction would be insecure with a hash function $H$ that isn't collision resistant, such as MD5. Even though normal HMAC-MD5 is still believed to be secure. In fact, any hash function with a small enough output size to lack collision resistance would be insecure to use in this modified HMAC.

If you use a collision resistant hash function, such as one of the SHA-2 hash functions (notably SHA-256 and SHA-512) or SHA-3 then the modified HMAC should still be secure.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ It comes down to what the question is. Is it "would doing HMAC(K, H(M)) yield any practical attacks", or "might there be academic attacks on HMAC(K, H(M)) that would be easier than HMAC(K, M)?" $\endgroup$
    – poncho
    Aug 18, 2015 at 17:10
  • 3
    $\begingroup$ @poncho, yeah, but "weaken" is pretty unambiguous. Whether it's weakened enough for a practical attack of course depends. $\endgroup$
    – otus
    Aug 18, 2015 at 17:39
  • $\begingroup$ @otus Tried to clarify part 2 and added a part about collision resistant hash functions in case this wasn't clear to everybody instead of posting my own answer. Hope you agree, roll back otherwise. $\endgroup$
    – Maarten Bodewes ♦
    Aug 18, 2015 at 20:07
7
$\begingroup$

Will it weaken the HMAC algorithm?

No, assuming that $H$ is a collision resistant hash function (which is a stronger constraint than what HMAC puts on the hash function).

The security property that a MAC (such as HMAC) has is that "given a large set of $message, tag=HMAC(K, message)$ pairs (where $K$ is an unknown key), where the attacker can choose the messages, the attacker cannot construct a new message, tag pair that validates".

This security property doesn't become any easier for the attacker if he is constrained to pick messages that correspond to images of H. Now, if the attacker could find a collision $H(M_1) = H(M_2)$, he could ask for the $HMAC(K, H(M_1))$, and then he would know $HMAC(K, H(M_2))$. However, if we assume collision resistance, this is infeasible, and so the attacker is limited to trying to break the underlying HMAC algorithm.

Improve this answer
$\endgroup$
3
  • 4
    $\begingroup$ Doesn't the fact that breaking HMAC generally requires a greater effort than finding a collision in the underlying hash algorithm, mean the answer is "yes"? $\endgroup$
    – Henrick Hellström
    Aug 18, 2015 at 15:27
  • 1
    $\begingroup$ @HenrickHellström: a "yes" answer is the same as (or at least compatible with) "no, assuming [something not in premise, and acknowledged as such]". $\endgroup$
    – fgrieu ♦
    Aug 19, 2015 at 6:27
  • $\begingroup$ @fgrieu Exactly. But I will accept the "Yes" answer as is the safest for other people when searching for answer to this. $\endgroup$
    – psorobka
    Aug 19, 2015 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.