6 Byte for HMAC in wireless system secure?

A wireless system has 8 byte payload and 6 byte for message authentication.

Scheme:

m := 8 Byte Message
k := 128 bit key
c := Encrypt(m,k)
hmac := secure_hashfunction(c, k) //(6 byte output)


Questions:

1. Is bruteforce possible when transmitting a single wireless package will take 7ms? If an attacker do a bruteforce attack it will take $2^{48} * 0.007 /\ 60 /\ 60 /\ 24/\ 365 = 62478.59\ years$ . So my assumption is that this system is secure if secure_hashfuncion is a cryptographically secure hash function.

2. Is there a hash algorithm that is cryptographically secure (only brute-force attacks possible) with a 6 byte output?

3. Can I maybe just use SHA-1 and only use the first 6 byte output?

• Is the MAC 6 bytes, or 5? It wouldn't change the answer either way, but still, you have both listed in your question Apr 16, 2018 at 14:47
• note: HMAC is a specific construction, not a generic term for building a MAC from a hash function with a key. Apr 16, 2018 at 15:24

1. Is bruteforce possible when transmitting a single wireless package will take 7ms? If an attacker do a bruteforce attack it will take $2^{48} * 0.007 /\ 60 /\ 60 /\ 24/\ 365 = 62478.59\ years$ . So my assumption is that this system is secure if secure_hashfuncion is a cryptographically secure hash function.

Actually, I would look at it this way; if the adversary injects a packet, it has a probability $2^{-48} \approx 3.55 \times 10^{-15}$ of being accepted; the attacker can increase this by (say) a factor of a million by using a million packets (which he could do over the course of a couple hours).

Is this "secure"? Well, that'd depend on your required level of security. If the effect if the adversary was successful was an ICBM launch, I'd say that we'd want to security to be better. However, if you're protecting a VoIP stream, and the effect would be to replace a 10msec sound segment, it'd probably be good enough.

1. Is there a hash algorithm that is cryptographically secure (only brute-force attacks possible) with a 6 byte output?

For MACs, there are two possible attack approaches; one is to guess the MAC (as above); the other is to try to recover the key. If you believe that you are sufficiently secure against the first attack, well, there certainly are MACs that are secure against key recovery attacks.

The only caution would be that there are MACs that, once you've found a forgery, make it easier to find other forgeries; GMAC is one such example. For this application, I'd stay away from that, and use one that doesn't have such a vulnerability; such as HMAC or CMAC [1].

1. Can I maybe just use SHA-1 and only use the first 6 byte output?

You'd have to stir in the key somehow. Now, I suppose you could hash the key and the message together (we typically don't because of length extension attacks, which do not apply because of your truncation); however unless you need to minimize computation, I'd still advise you to use a more traditional MAC, such as HMAC (such is close to what you are proposing), or CMAC.

[1]: CMAC does have that vulnerability, but only if the attacker guesses the entire 128 bit tag; guessing a truncated version (without getting the rest of the bits right doesn't help him)