# Improving the security of this tag

So we have the protocol:

$Bob \to Alice \Rightarrow m\ ||\ h(m, secretTag")$

With above scenario, a message is passed to Alice with an authentication tag to prove that the message was sent by Bob.

What is a better way of doing the tag? How could I incorporate a key into this?

A suggestion has been to use Digital signatures or HMAC, how are these better?

• Digital Signatures or HMAC. – SEJPM Nov 14 '16 at 22:41
• What's the difference? – NoDirection Nov 14 '16 at 23:23
• Digital signatures require an asymmetric key pair (e.g. RSA) with the public key at the receiver and the private key at the sender while HMAC requires a shared symmetric key. If you want to use a password string you may also require a PBKDF function such as PBKDF2 to derive the secret key. – Maarten Bodewes Nov 15 '16 at 0:53
• What makes RSA or HMAC better for this scenario? – NoDirection Nov 15 '16 at 8:44

Please read the article on HMAC. What you are trying is exactly what is described in the chapter design principle:

The design of the HMAC specification was motivated by the existence of attacks on more trivial mechanisms for combining a key with a hash function. For example, one might assume the same security that HMAC provides could be achieved with $MAC = H(key ∥ message)$. However, this method suffers from a serious flaw: with most hash functions, it is easy to append data to the message without knowing the key and obtain another valid MAC ("length-extension attack"). ...

There are only two differences to your idea:

• Reverse the order of message and key/tag
• The idea of having a "tag", where I can only assume it is the usual case as with passwords: Low entropy, unsuitable to be used as a cryptographic key.

So basically you should just use HMAC (if that fits your needs), but put your tag into a password-based key derivation function first, e.g. PBKDF2, scrypt or bcrypt. That key can then be used for HMAC.

Digital signatures on the other hand also offer non-repudiation, and HMACs don't because both the sender and the receiver know the same symmetric key and thus could both have created the HMAC.

• This is great. thanks. Although in this example is the message being concatenated along with the hashed message. In other words is this happening: m || h(m,‘‘secretTag") So... "Message" + 85URYEQIA4 – NoDirection Nov 15 '16 at 21:03
• Well yeah, a HMAC is not used to reconstruct the message. It is appended to the message itself for authenticity. That is given implicitly by the construction. – tylo Nov 16 '16 at 11:00
• I'm just confused as to why in the given scenario the message is being appended/concatenated to the hashed value. Doesn't that just reveal the contents of the message if an adversary were to spy on this? – NoDirection Nov 16 '16 at 11:09
• Authentication has nothing to do with confidentiality, which is usually achieved by encryption. But that's the case in your question as well. But there are certain modes of operation, which achieve both at the same time, called "authenticated encryption" – tylo Nov 16 '16 at 11:12
• Thanks tylo, so this example has no form of encryption at all and therefore no confidentiality has been given to the content of the message? – NoDirection Nov 16 '16 at 12:35