The original HMAC algorithm is as follows:
H(K XOR opad || H(K XOR ipad || text))
What if text would replaced with H(text)? Will it weaken the HMAC algorithm?
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
3
What if
textwould replaced withH(text)? Will it weaken the HMAC algorithm?
Yes. It makes collision attacks on the hash function apply to the MAC, which isn't normally the case with HMAC. You can find a pair $(m, m')$ that hash to the same value, get the MAC for one of them and move it to the other.
That means that your modified HMAC construction would be insecure with a hash function $H$ that isn't collision resistant, such as MD5. Even though normal HMAC-MD5 is still believed to be secure. In fact, any hash function with a small enough output size to lack collision resistance would be insecure to use in this modified HMAC.
If you use a collision resistant hash function, such as one of the SHA-2 hash functions (notably SHA-256 and SHA-512) or SHA-3 then the modified HMAC should still be secure.
-
1$\begingroup$ It comes down to what the question is. Is it "would doing HMAC(K, H(M)) yield any practical attacks", or "might there be academic attacks on HMAC(K, H(M)) that would be easier than HMAC(K, M)?" $\endgroup$– ponchoAug 18, 2015 at 17:10
-
3$\begingroup$ @poncho, yeah, but "weaken" is pretty unambiguous. Whether it's weakened enough for a practical attack of course depends. $\endgroup$– otusAug 18, 2015 at 17:39
-
$\begingroup$ @otus Tried to clarify part 2 and added a part about collision resistant hash functions in case this wasn't clear to everybody instead of posting my own answer. Hope you agree, roll back otherwise. $\endgroup$– Maarten Bodewes ♦Aug 18, 2015 at 20:07
$\begingroup$
$\endgroup$
3
Will it weaken the HMAC algorithm?
No, assuming that $H$ is a collision resistant hash function (which is a stronger constraint than what HMAC puts on the hash function).
The security property that a MAC (such as HMAC) has is that "given a large set of $message, tag=HMAC(K, message)$ pairs (where $K$ is an unknown key), where the attacker can choose the messages, the attacker cannot construct a new message, tag pair that validates".
This security property doesn't become any easier for the attacker if he is constrained to pick messages that correspond to images of H. Now, if the attacker could find a collision $H(M_1) = H(M_2)$, he could ask for the $HMAC(K, H(M_1))$, and then he would know $HMAC(K, H(M_2))$. However, if we assume collision resistance, this is infeasible, and so the attacker is limited to trying to break the underlying HMAC algorithm.
-
4$\begingroup$ Doesn't the fact that breaking HMAC generally requires a greater effort than finding a collision in the underlying hash algorithm, mean the answer is "yes"? $\endgroup$ Aug 18, 2015 at 15:27
-
1$\begingroup$ @HenrickHellström: a "yes" answer is the same as (or at least compatible with) "no, assuming [something not in premise, and acknowledged as such]". $\endgroup$– fgrieu ♦Aug 19, 2015 at 6:27
-
$\begingroup$ @fgrieu Exactly. But I will accept the "Yes" answer as is the safest for other people when searching for answer to this. $\endgroup$– psorobkaAug 19, 2015 at 15:38