3
$\begingroup$

Saarinen in his work GCM, GHASH and Weak Keys says that;

The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and this) for these algorithms indicate that a $n-$bit tag will give $2^{−n/2}$ security against forgery.

It can be argued that universal hashes sacrifice some communication bandwidth for convenience as traditional hash-based MACs are designed to reach the information theoretic $2^{−n}$ bound against message forgery.

  • What is the convenience of universal hashes provides?
  • How much GHASH increase on the communication?.
  • Why one should not use an information theoretic bound HMAC instead should use a lesser one?
  • Since GHASH provides at most $2^{64}$ security against forgery in TLS 1.3, and that is standard that cannot be changed, are there any other suites that provide information theoretical security against forgery.

note: He also says that

In this paper we give further evidence that this is not only the security lower bound but an upper bound as well. (for universal hashes )

$\endgroup$
3
$\begingroup$

What is the convenience of universal hashes provides?

They are simple to describe: $X_i=(X_{i-1}+D_i)\cdot H$, with $D_i$ being the $i$-th data word and $H$ being a key/iv-dependent secret and are really fast to evaluate in hardware and reasonably fast to evaluate in software. This is especially true if you consider the fact that hashes usually have 64 or more rounds to process one 512-bit block.

How much Ghash increase on the communication?

The point being made in the paper is probably that CW polynomial hashes only provide a security level of $n/2$ bits for $n$-bit tags, which means to hit security level $k$ you need $2k$-bit long tags and thus a little bit more bandwidth.

Why one should not use an information theoretic bound HMAC instead should use a lesser one?

If you have the bandwidth or can live with the slightly reduced security guarantee, the speed benefit can be very appealing, especially if hardware support is available, as is the case eg on x86. In the end it doesn't matter whether your MAC is "optimal", but only whether it does what it needs to do and whether it does it efficiently and if $2k$-bit polyomial hash is faster than a $k$-bit hash-based MAC, one usually would prefer the faster one as both provide the same security level.

Since GASH provides at most $2^{64}$ security against forgery in TLS 1.3, and that is standard that cannot change, are there any other suites that provides information theoretical security against forgery.

Yes, RFC 8446 specifies TLS_AES_128_CCM_SHA256. Though note that it is not mandatory to implement it unlike TLS_AES_128_GCM_SHA256.

$\endgroup$

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.