Why does setting the secret key to a fixed, public value not make MACs like CBC-MAC or EMAC into secure unkeyed cryptographic hash functions?

In other words, why is the resulting hash function not 1st pre-image, 2nd pre-image, and collision resistant?

What about HMAC? Still not pre-image and collision resistant?


1 Answer 1


GMAC, for example, is trivially broken if used as an unkeyed hash algorithm.

GMAC is effectively a series of operations on blocks where you take the previous state, XOR it with the next block, then multiply it in $GF(2^{128})$ by the derived secret subkey $H$. That is, for data block $A_i$, the next hash value is computed from the previous one as follows:

$X_i = (X_{i-1} \oplus A_i) \cdot H$

$H$ is itself simply the result of encrypting a block of entirely zero bits with the cipher and secret key. Thus, if the secret key is fixed, $H$ is known to an attacker.

With this design, with $H$ public, preimage attacks are trivial. Let's say that you have a previous state $X_i$ and want to cause the next state of the hash, $X_{i+1}$, to be equal to $P$, your target hash. You need to determine $A_{i+1}$ such that:

$P = X_{i+1} = (X_i \oplus A_{i+1}) \cdot H$

Solving for $A_{i+1}$, we get this, with $H^{-1}$ easily computable from $H$:

$A_{i+1} = (P \cdot H^{-1}) \oplus X_i$

Thus, you can arbitrarily control what the next hash value will be, a preimage attack. If you don't know $H$, though, you can't do this attack.

In short, don't use MACs as general hash functions, even though it happens to work for some MACs (e.g. HMAC).


Not the answer you're looking for? Browse other questions tagged or ask your own question.