1
$\begingroup$

SHA-1 is considered broken. That's why I'm assuming that using SHA-1 for RFC2289 OTPs is broken as well. Is this assumption correct?

Going further with this assumption using SHA-1 for RFC4226 HOTPs should be broken too, is it? Although this blog states the following: "it doesn't affect applications such as HMAC where collisions aren't important". Does this also applies for HOTP?

A detailed explanation would be really appreciated.

Thank you very much in advance.

$\endgroup$
  • 2
    $\begingroup$ collision is not important for passwords. You need a pre-image. $\endgroup$ – kelalaka Feb 2 at 16:25
  • 2
    $\begingroup$ @kelalaka The question is about one-time passwords (which needs a pseudorandom function), not password hashing. $\endgroup$ – Yehuda Lindell Feb 2 at 17:39
1
$\begingroup$

The security property needed for one-time password generation is that of a pseudorandom function. HMAC is assumed to be a pseudorandom function, when the hash function has certain properties. Collision resistance is not a required property for HMAC to be a secure pseudorandom function. However, when collision resistance is broken, this brings into question the general security of the function. As such, although HMAC-SHA1 is not actually broken, it is worthwhile looking at phasing into HMAC-SHA256, when possible.

I will just note that HMAC-SHA1 does not require collision resistance in the normal sense, since it is designed so that the hash of the message is prefixed by a secret key. Thus, the attacker is unable to compute the hash of the message itself.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I see. Why not use NMAC since it is proven to be secure PRF? $\endgroup$ – kelalaka Feb 2 at 17:48
  • 1
    $\begingroup$ HMAC is proven in the same way as NMAC, with slightly different assumptions on the primitive. The problem with NMAC is that it requires calling the compression function inside the hash function, and cannot be implemented by standard calls to the hash function. Being able to just call SHA directly is one of the design aims of HMAC, and it makes it simple to implement. $\endgroup$ – Yehuda Lindell Feb 3 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.