2
$\begingroup$

I know that NMAC is mathematically proved with two different keys with length $L$.

But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of length ​$2L$, ​am I vulnerable to some attacks?

Improve this question
$\endgroup$
4
  • $\begingroup$ But you'd still use the same key both times in there? $\endgroup$
    – SEJPM
    Dec 6, 2016 at 9:44
  • $\begingroup$ Yes, I think this way i'm vulnerable to length extension attack (if implemented with markle-damgard), Am I right? $\endgroup$
    – Abmen
    Dec 6, 2016 at 15:37
  • 1
    $\begingroup$ Length-extension attacks don't apply here, given that the outer layer has constant input length. This construction is equivalent to the $\text{NMAC}_3$ construction studied in eprint.iacr.org/2011/649. Its exact security is unknown. $\endgroup$
    – Samuel Neves
    Dec 6, 2016 at 19:14
  • $\begingroup$ @SamuelNeves In that case it's an answer :) We're not supposed to do original research to get to an answer here. $\endgroup$
    – Maarten Bodewes ♦
    Dec 6, 2016 at 22:22

0

Reset to default

Browse other questions tagged or ask your own question.