Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Why does setting the secret key to a fixed, public value not make MACs like CBC-MAC or EMAC into secure unkeyed cryptographic hash functions?
In other words, why is the resulting hash function not 1st pre-image, 2nd pre-image, and collision resistant?
What about HMAC? Still not pre-image and collision resistant?
GMAC, for example, is trivially broken if used as an unkeyed hash algorithm.
GMAC is effectively a series of operations on blocks where you take the previous state, XOR it with the next block, then multiply it in $GF(2^{128})$ by the derived secret subkey $H$. That is, for data block $A_i$, the next hash value is computed from the previous one as follows:
$X_i = (X_{i-1} \oplus A_i) \cdot H$
$H$ is itself simply the result of encrypting a block of entirely zero bits with the cipher and secret key. Thus, if the secret key is fixed, $H$ is known to an attacker.
With this design, with $H$ public, preimage attacks are trivial. Let's say that you have a previous state $X_i$ and want to cause the next state of the hash, $X_{i+1}$, to be equal to $P$, your target hash. You need to determine $A_{i+1}$ such that:
$P = X_{i+1} = (X_i \oplus A_{i+1}) \cdot H$
Solving for $A_{i+1}$, we get this, with $H^{-1}$ easily computable from $H$:
$A_{i+1} = (P \cdot H^{-1}) \oplus X_i$
Thus, you can arbitrarily control what the next hash value will be, a preimage attack. If you don't know $H$, though, you can't do this attack.
In short, don't use MACs as general hash functions, even though it happens to work for some MACs (e.g. HMAC).
