7
$\begingroup$

$\require{begingroup}\begingroup \DeclareMathOperator{\keccak}{\mathrm{Keccak}} \DeclareMathOperator{\concat}{\|} $According to Keccak's website, $\keccak(k \concat x)$ is safe:

Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key.

My question is, is $\keccak(x \concat k)$ safe?

I read Why is $H(k\mathbin\Vert x)$ not a secure MAC construction? but I guess it doesn't apply to Keccak. $\endgroup$

Improve this question
$\endgroup$
0

2 Answers 2

Reset to default
10
$\begingroup$

See chapter 5.11.2 of the paper “Cryptographic sponge functions” (the link can be found here):

Note that one can also define a MAC function by taking as input the message followed by the key: $t = \left\lfloor {F(M \mathbin\Vert K)} \right\rfloor _n$. In this case, an adversary has the advantage that she can try to generate inner collisions offline, i.e., without having to query the keyed sponge function. Additionally, she can try to construct a path to a state that occurs in the absorbing of a target message, leading to a second message with the same MAC.

Improve this answer
$\endgroup$
3
  • $\begingroup$ For an offline attack you would need to create a collision on the full 1600 bit internal state, a rather tall order. in case finding sha3 collision wasn't hard enough. $\endgroup$
    – Meir Maor
    Jul 31, 2018 at 4:22
  • 1
    $\begingroup$ @MeirMaor: But $\text{Keccak-}f[b]$ permutations are defined for all $b \in \{25, 50, 100, 200, 400, 800, 1600\}$, thus the full internal state is not required to be always equal to 1600 bits. $\endgroup$
    – lyrically wicked
    Jul 31, 2018 at 4:43
  • 1
    $\begingroup$ SHA-3 only uses $b = 1600$, so Meir Maor's statement is about SHA-3, but the question was about Keccak in general. But if I understand the quote right, an inner collision is a collision in the capacity section of the sponge state, which I believe is sufficient to construct a full state collision (top of p. 17 for the linked paper on sponge functions). $\endgroup$
    – Luis Casillas
    Jul 31, 2018 at 17:15
5
$\begingroup$

Keccak(x||k) is very likely secure, but it is less efficient than Keccak(k||x) for multiple messages.

The standardized MAC construction for use with Keccak is KMAC as defined in FIPS 800-185. In KMAC, you first absorb the key padded to the rate length of the sponge. You can then copy the resulting Keccak state, and re-use it for all messages which will use the same MAC key.

With KMAC you don’t need to re-absorb the same key repeatedly for each message. This can make a significant performance benefit for MAC of many small messages (such as VPN packets).

In short: use KMAC.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.