2
$\begingroup$

SHA-1 is considered broken. That's why I'm assuming that using SHA-1 for RFC2289 OTPs is broken as well. Is this assumption correct?

Going further with this assumption using SHA-1 for RFC4226 HOTPs should be broken too, is it? Although this blog states the following: "it doesn't affect applications such as HMAC where collisions aren't important". Does this also applies for HOTP?

A detailed explanation would be really appreciated.

Thank you very much in advance.

$\endgroup$
2
  • 2
    $\begingroup$ collision is not important for passwords. You need a pre-image. $\endgroup$
    – kelalaka
    Commented Feb 2, 2020 at 16:25
  • 2
    $\begingroup$ @kelalaka The question is about one-time passwords (which needs a pseudorandom function), not password hashing. $\endgroup$ Commented Feb 2, 2020 at 17:39

1 Answer 1

2
$\begingroup$

The security property needed for one-time password generation is that of a pseudorandom function. HMAC is assumed to be a pseudorandom function, when the hash function has certain properties. Collision resistance is not a required property for HMAC to be a secure pseudorandom function. However, when collision resistance is broken, this brings into question the general security of the function. As such, although HMAC-SHA1 is not actually broken, it is worthwhile looking at phasing into HMAC-SHA256, when possible.

I will just note that HMAC-SHA1 does not require collision resistance in the normal sense, since it is designed so that the hash of the message is prefixed by a secret key. Thus, the attacker is unable to compute the hash of the message itself.

$\endgroup$
2
  • $\begingroup$ I see. Why not use NMAC since it is proven to be secure PRF? $\endgroup$
    – kelalaka
    Commented Feb 2, 2020 at 17:48
  • 1
    $\begingroup$ HMAC is proven in the same way as NMAC, with slightly different assumptions on the primitive. The problem with NMAC is that it requires calling the compression function inside the hash function, and cannot be implemented by standard calls to the hash function. Being able to just call SHA directly is one of the design aims of HMAC, and it makes it simple to implement. $\endgroup$ Commented Feb 3, 2020 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.