What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
$\begingroup$
$\endgroup$
0
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
Should be comparable in strength to $H(m||k)$. The weakness is that a collision in the inner hash breaks the MAC. Using strong hashes the strength in bits is $\min(2^{n_O},2^{{n_I}/2})$ where $n_O$ is the output size of the outer hash and $n_I$ the output size of the inner hash.
But since cryptoanalysis usually breaks collision resistance long before it breaks keyed modes like HMAC, it's riskier than the security loss against generic attacks indicates.
answered May 2, 2016 at 6:53
$\begingroup$
$\endgroup$
The strength here depends on the collision resistance of $H$. If $H$ is not collision resistant, like MD5, then the attacker can find $H(m) = H(m')$, ask for the MAC of one message and forge it for the other.
So for many secure hashes you lose half the security bits. E.g. SHA-256 should give you a 256-bit secure HMAC, but would be at most 128-bit secure in this construction, because its collision resistance is much lower than its preimage resistance.
So you need to assume more about the hash function. HMAC has proofs which do not require collision resistance. This one cannot have such proofs, and its proofs will at least have to assume collision resistance. Possibly other properties.
Compared to $H(m \| k)$?
The story there is similar. A collision attack breaks that MAC. However, at least you do not need two calls to the hash function so you have something faster than HMAC...
($H(k \| H(m))$ is no faster than HMAC, if you cache the result of the inner key hash, which gets used as a chaining value/IV for the inner message hash in HMAC.)
