1
$\begingroup$

What are the security risks, if I use a hash function $H$ such that $Y=H(K||M||N)$ where $K$ is a secret key, $M$ is a message, $N$ is a nonce and $||$ is concatenation operation (where the length of $K||M||N$ is fix and is less than or equal to block size of the hash $H$)?

$\endgroup$
1
$\begingroup$

In general, the construction $H(K||M||N)$ where $H, Y, N$ are known to an attacker is arguably no more secure than $H(K||M)$, which we already know to be broken. For that latter construction, we can easily forge a MAC of the form $K||M||PADDING||Z$ for some message $Z$.

This same attack would apply to the construction proposed in the question, except the forgery would be of the form $K||M||N||PADDING||Z||N$. This attack is feasible on many currently used hash functions, however, is not feasible on the new SHA-3.

$\endgroup$
  • $\begingroup$ I think the message extension attack is only valid if an attacker can extend the length of the modified message. What if all the parameters M,K and N are fixed in length and collectively they are less than equal to the block size of the hash as I have indicated in the question. $\endgroup$ – prosaad Dec 22 '17 at 19:30
  • $\begingroup$ If that is guaranteed, then clearly the attack wouldn't work and like there is no other attack. That said, usage typically changes over time and you may quickly find yourself in a use case where the attack does work. So I would still stick to known good standards. $\endgroup$ – mikeazo Dec 23 '17 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.