I was just thinking about improving the performance of HMAC - what would be the issues in doing the following:

Let $G_K(IV,M)$ be GMAC with a key $K$, for IV and message $M$. Let $H$ be a secure hash function - e.g. SHA-512, SHA3, ...

Then we define $ HG_{K_1,K_2}(M) = H\left(K_1||G_{K2}(0,M)\right)$. While it is known that reusing IV leaves GMAC vulnerable, does wrapping it in this way solve the issues (or only partially)? Are there any obvious vulnerabilities (the tag produced by GMAC is 128 bits - so we can't expect security better than that)?


Browse other questions tagged or ask your own question.