2
$\begingroup$

Suppose there is a hashing function:

$$ph = bcrypt(sha256(m + k), salt)$$

Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret key $k$. Assuming that

  1. key $k$ is not visible to attacker;
  2. key is a "truly" random sufficiently large string;
  3. the work factor of $bcrypt$ is sufficiently large as well;

The question is how much is this schema secure? Can an attacker obtain the secret key $k$ by issuing messages $m$ and retrieving hashes $ph$ and how much efforts will it take? How much does the strength of this schema depend on the size of the key?

Are there any ways to improve this schema?

I thought such schema may be used for MAC. Should I use HMAC+SHA512 instead?

Improve this question
$\endgroup$
2
  • $\begingroup$ What would be the advantage over a normal MAC? HMAC is considered pretty secure (and KMAC for SHA-3 will likely share that property). You're missing the work factor in your parameters. c is not a ciphertext. A ciphertext is the result of encryption. This is a (password) hash result (some people may go for the phash term here). I don't think you can compare that with a IND_CPA as used for a block cipher based encryption scheme. $\endgroup$
    – Maarten Bodewes ♦
    May 23, 2016 at 11:22
  • $\begingroup$ @MaartenBodewes thanks for your comment! I'll correct the question. What about HMAC.. Could you please describe disadvantages of my schema with the answer? If you want and able, of course. It may be helpful for others. May the schema be considered as secure with sufficiently large work factor? Fast signing of message is not required. $\endgroup$
    – Alex Sidorov
    May 23, 2016 at 11:29

2 Answers 2

Reset to default
3
$\begingroup$

The question is how much is this schema secure?

Not significantly more secure than sha256(m + k) is and may be less secure. An attacker who could arrange a collision for that would trivially also get a collision for the bcrypt hash of that, regardless of the salt value.

While SHA-256 is collision resistant, there are MACs that have better bounds, like HMAC, which does not need to rely on the collision resistance of the hash. Using bcrypt like this when you already have a strong key is just a waste.

How much does the strength of this schema depend on the size of the key?

As long as the key is at least 128 bits, it should be secure. It will not be much more secure even with a long key, due to the collision attack mentioned, and if the collision resistance of SHA-256 is ever broken then it may be insecure.

Should I use HMAC+SHA512 instead?

That is one good alternative.

Improve this answer
$\endgroup$
4
$\begingroup$

Although your scheme is secure - especially with a random key of 32 bytes or higher - it won't offer any benefit over HMAC. It's therefore not recommended to use such a scheme.

Also note that `bcrypt has been designed for key stretching which is deliberately not efficient. You have ample entropy in your key so there is no need for key stretching.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.