2
$\begingroup$

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows:

H(secret_key||timestamp), so that the attacker knows the result and the timestamp.

Is it possible to produce a valid MAC of H(secret_key||timestamp+1) with length-extension or other attack?

| improve this question | |
$\endgroup$
3
$\begingroup$

No, the length extension property does not allow to compute $H(\text{secret_key}\mathbin\|\text{timestamp}+1)$ from $H(\text{secret_key}\mathbin\|\text{timestamp})$ and $\text{timestamp}$.

Two caveats:

  • That's for reasonable encoding of integers to bitstring for the $\text{timestamp}$ field, including anything fixed-size, ASN.1, Integer-to-Octet-String Conversion, and any conceivable variation. Argument: the length extension property computes the hash of a message larger than the original by the padding size (at least 65-bit for SHA-256), and further that much of the extension is heavily constrained.
  • What's considered is not an intended use of $H$, and we have no convincing argument of security from other attacks. The academically sound thing is to use a MAC, for example HMAC with $\text{secret_key}$ as the key and $\text{timestamp}$ as the message.
| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks for your response. What I've seen in a real implementation is as follows in python2.7: data = secret_key + unix_timestamp , token_hash = hashlib.sha256(data).hexdigest(). That token_hash is being used as auth and mac. The timestamp is in seconds !. $\endgroup$ – jdcaballerov Jul 22 '18 at 0:58
  • 1
    $\begingroup$ @jdcaballerob: that allows to compute $H(\text{secret_key}\mathbin\|\text{timestamp}+x)$ with probability $1-x$ when $x<1\text{ second}$ ! $\endgroup$ – fgrieu♦ Jul 22 '18 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.