3
$\begingroup$

It is widely known, generally, that a MAC is a HASH with key. I just want to ensure that my understanding is correct to avoid base further assumptions on wrong conception. So, if I used MAC that uses strong key but weak HASH such as MD-5. Does this means my MAC does not provide security and can be forged?

$\endgroup$
5
$\begingroup$

It is widely known, generally, that a MAC is a HASH with key.

Nope; there are plenty of perfectly good MACs that, if you know the key, aren't very good hashes at all. Examples of this would include CMAC and GMAC; in both cases, if you know the key, it's easy to generate an image that MACs to a specific value.

However, lets assume that you're talking about HMAC specifically (which is a specific type of MAC based on a hash function).

So, if I used MAC that uses strong key but weak HASH such as MD5. Does this means my MAC does not provide security and can be forged?

Depends on how weak the MAC is. With MD5, we can easily generate collisions (that is, pairs of images that hash to the same value), however that's not useful in attacking HMAC-MD5 (assuming the attacker doesn't know the key; if he does, he can use that knowledge to create two values that HMAC-MD5 to the same tag). In fact, there's no known attack against HMAC-MD5 that's more effective than "brute force search of the key".

Please don't use this advice as an excuse to use HMAC-MD5, however.

On the other hand, a sufficiently weak hash (e.g. MD4) does give you a weak HMAC; and so the answer to your question is "yes, a weak hash can give you a weak HMAC"; the hash just has to be weaker than what we know MD5 to be...

$\endgroup$
3
$\begingroup$

The key thing you're missing here is that collision resistant hash functions ("CRHFs," what we normally call just "crypto hashes") and message authentication codes ("MACs") have substantially different security goals. CRHFs must meet these goals:

  • Collision resistance: Attacker can't easily find two messages that hash to the same value.
  • Preimage resistance: Attacker can't easily find a message that hashes to a defender-selected value.
  • Second preimage resistance: Attacker can't easily find a message that hashes to the same value as a defender-selected message.

Whereas a MAC must meet this goal:

  • Existential forgery resistance: An attacker that doesn't know the key can't easily forge any valid message + tag pair.

It is widely known, generally, that a MAC is a HASH with key.

The term "keyed hash function" doesn't say you whether you're talking about a keyed CRHF or a MAC. The former normally connotes that the attacker is allowed to know the key, the latter that the attacker must not know it.

So, if I used MAC that uses strong key but weak HASH such as MD-5. Does this means my MAC does not provide security and can be forged?

I think you're confusing MAC (the security goal) with HMAC (a specific family of MACs, built on top of CRHFs). The answer to your question is that whether MD5 is a good CRHF (which it isn't!) is a separate question from whether HMAC-MD5 is a good MAC (which cryptographers are skeptical that it is, but haven't proven otherwise so far).

Think of it this way: it's like asking, based on the poor performance of some sports car, whether a pickup truck with the same V8 engine is also bad. A sports car and a truck have different uses, so the answers could be different.

What I'd advice is to think very carefully about which cryptographic terms refer to functions, algorithms or implementations vs. which refer to goals, requirements or security claims:

  • "MD5" and "HMAC" are in the former camp (functions/algorithms);
  • "CRHF" and "MAC" are in the latter (security goals);
  • "Hash function" and "keyed hash" are ambiguous. This should set off warning bells!

Note also that one function can be good for more than one goal. For example, Blake2 is an optionally keyed hash function that's intended to be secure both as a CRHF and as a MAC. People often talk about these two categories as if they're distinct sets of functions, but they're not so—they're different goals that a function may or may not meet.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.