2
$\begingroup$

SHA-1 is considered broken. That's why I'm assuming that using SHA-1 for RFC2289 OTPs is broken as well. Is this assumption correct?

Going further with this assumption using SHA-1 for RFC4226 HOTPs should be broken too, is it? Although this blog states the following: "it doesn't affect applications such as HMAC where collisions aren't important". Does this also applies for HOTP?

A detailed explanation would be really appreciated.

Thank you very much in advance.

Improve this question
$\endgroup$
2
  • 2
    $\begingroup$ collision is not important for passwords. You need a pre-image. $\endgroup$
    – kelalaka
    Feb 2, 2020 at 16:25
  • 2
    $\begingroup$ @kelalaka The question is about one-time passwords (which needs a pseudorandom function), not password hashing. $\endgroup$
    – Yehuda Lindell
    Feb 2, 2020 at 17:39

1 Answer 1

Reset to default
2
$\begingroup$

The security property needed for one-time password generation is that of a pseudorandom function. HMAC is assumed to be a pseudorandom function, when the hash function has certain properties. Collision resistance is not a required property for HMAC to be a secure pseudorandom function. However, when collision resistance is broken, this brings into question the general security of the function. As such, although HMAC-SHA1 is not actually broken, it is worthwhile looking at phasing into HMAC-SHA256, when possible.

I will just note that HMAC-SHA1 does not require collision resistance in the normal sense, since it is designed so that the hash of the message is prefixed by a secret key. Thus, the attacker is unable to compute the hash of the message itself.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I see. Why not use NMAC since it is proven to be secure PRF? $\endgroup$
    – kelalaka
    Feb 2, 2020 at 17:48
  • 1
    $\begingroup$ HMAC is proven in the same way as NMAC, with slightly different assumptions on the primitive. The problem with NMAC is that it requires calling the compression function inside the hash function, and cannot be implemented by standard calls to the hash function. Being able to just call SHA directly is one of the design aims of HMAC, and it makes it simple to implement. $\endgroup$
    – Yehuda Lindell
    Feb 3, 2020 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.