Why does setting the secret key to a fixed, public value not make MACs like CBC-MAC or EMAC into secure unkeyed cryptographic hash functions?

In other words, why is the resulting hash function not 1st pre-image, 2nd pre-image, and collision resistant?

What about HMAC? Still not pre-image and collision resistant?


GMAC, for example, is trivially broken if used as an unkeyed hash algorithm.

GMAC is effectively a series of operations on blocks where you take the previous state, XOR it with the next block, then multiply it in $GF(2^{128})$ by the derived secret subkey $H$. That is, for data block $A_i$, the next hash value is computed from the previous one as follows:

$X_i = (X_{i-1} \oplus A_i) \cdot H$

$H$ is itself simply the result of encrypting a block of entirely zero bits with the cipher and secret key. Thus, if the secret key is fixed, $H$ is known to an attacker.

With this design, with $H$ public, preimage attacks are trivial. Let's say that you have a previous state $X_i$ and want to cause the next state of the hash, $X_{i+1}$, to be equal to $P$, your target hash. You need to determine $A_{i+1}$ such that:

$P = X_{i+1} = (X_i \oplus A_{i+1}) \cdot H$

Solving for $A_{i+1}$, we get this, with $H^{-1}$ easily computable from $H$:

$A_{i+1} = (P \cdot H^{-1}) \oplus X_i$

Thus, you can arbitrarily control what the next hash value will be, a preimage attack. If you don't know $H$, though, you can't do this attack.

In short, don't use MACs as general hash functions, even though it happens to work for some MACs (e.g. HMAC).

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.