1
$\begingroup$

NMAC uses an fpad value that is appended to the output of the Cascade function in the penultimate step of the algorithm (as depicted here, p.63) before it is sent to the last step of the NMAC algorithm to produce final tag.

I found that opad and ipad values used in HMAC are one-block constants (0x5c5c5c…5c5c and 0x363636…3636 respectively). I could not find the same for the NMAC's fpad.

What is the value of the fpad? Is it fixed and well-defined? Is it expected to be defined by the standard/cryptosystem that may decide to employ NMAC?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

If you look at the original publication of NMAC & HMAC you will notice that there is no such padding in NMAC and in HMAC the constants are XORed with the key.

I don't know where this fpad comes from. It's not mentioned in the HMAC RFC either.

Found it! It is mentioned in the paper with the update security proofs. But there it is stated that it doesn't need to fulfill any requirements (p. 7). I assume that it is not defined in practice because the practical implementation of NMAC is HMAC and, as also stated in the above paper, leaving it out entirely is fine.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thank you for the pointers! One quote from the original publication that I feel is relevant (a bit paraphrased): The outer function is basically the compression function acting on output of the Cascade function padded to a full block size (in some standard way as defined by the underlying hash scheme F). $\endgroup$
    – golem
    Apr 13, 2017 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.