1
$\begingroup$

I have seen other questions like this one, but I am asking this specifically in the context of Riot messaging and the underlying Matrix protocol.

A basic summary of their message encryption (using keys derived from the key ratcheting Olm primitive, details in the section "Olm authenticated encryption" in the Olm spec) is that messages are encrypted with AES-256-CBC, then authenticated with truncated HMAC-SHA256. Only the first 8 bytes of the HMAC code are sent with the message.

Doesn't this provide only 64-bit protection against MAC forgery? Wouldn't it make more sense to include at least 128 bits so as to match the security of the Curve25519 identity keys underlying the ratchet?

While the 2012 NIST document linked in this answer states that at least 64 bits of HMAC is recommended, is a higher security margin called-for nowadays?

$\endgroup$

1 Answer 1

1
$\begingroup$

I once had a similar question, and the answer is that: MAC forgery attack targets interacting parties, where as other types of attack such as key-guessing and message decryption targets static messages.

To attack interacting parties with MAC forgery, you can only know if you succeed after they've replied decryption success/failure indication, by which time they would probably have terminated the communication or re-keyed.

On the other hand, if you've enough money to spend on a supercomputer to crack a 64-bit key to decrypt a ciphertext, you can wait as long as you want, and each failure doesn't cause you to start all over again - you can continue where you left.

$\endgroup$
1
  • 1
    $\begingroup$ Additional context for anyone else who stumbles on this later: the Olm ratchet used in Matrix rekeys with each message, so there is no chance for an active attacker to test whether a MAC forgery is successful or not. $\endgroup$
    – rlee827
    Mar 30, 2019 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.