2
$\begingroup$

I refer to the question for-a-one-time-pad-which-mac-method-is-information-theoretically-secure, and specifically the exchange between lightspeeder & kasperd.

I've found the discussion a little advanced, but can I infer that:-

  1. Any hash can be used for message authentication, including MD5?
  2. The MAC tag must be encrypted with the OTP?
  3. The size of the hash only affects the probability of a successful forgery?
  4. The inherent security proof of a OTP is maintained even by appending a MAC to the plain text, then encrypting?

Can anyone confirm (hopefully) my interpretation?

$\endgroup$
2
$\begingroup$

Taken in order:

  1. Any hash can be used for message authentication, including MD5?

No. A message authentication code or tag is generated by using a keyed cryptographic hash function. Raw MD5 is an [unkeyed] cryptographic hash function. One of the goals of this type of primitive is that it should not be feasible to create a valid tag for a message without the key. If you have no key, as with MD5, it's easy for anyone to compute a valid hash of the message. MD5 might be used internally within a MAC algorithm, but not as a MAC algorithm.

  1. The MAC tag must be encrypted with the OTP?

No. In fact, you can see in the 2nd to last paragraph of kasperd's answer that when an appropriate (information theoretically secure) construction is chosen, it does not matter if the tag is encrypted with the OTP or not, though there is some additional cost for encrypting it with the OTP with no corresponding security gain.

  1. The size of the hash only affects the probability of a successful forgery?

Yes, that is the primary goal of the tag, which is the output of the MAC algorithm.

  1. The inherent security proof of a OTP is maintained even by appending a MAC to the plain text, then encrypting?

This is true if the MAC algorithm provides information theoretic security, such as Wegman-Carter authetication, as kasperd pointed out in his answer. This is not true for other MACs, such as HMAC which was the original object of the question.

$\endgroup$
  • $\begingroup$ @PaulUszak For use with a OTP, you want a universal hashing algoithm like VMAC or GHASH as defined in the GCM specification. $\endgroup$ – Xander Oct 19 '16 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.