I know that SHA(key || msg) is vulnerable to string concatenation attack. However, what if we specified key bit-length and msg bit-length? For example, key bit-length is 256 bit and msg bit-length is 256 bit. If msg or key bit-length is longer than 256 then we simply don't do anything. In this situation, will there be any differences between SHA(key || msg) and MAC(key, msg)??
$\begingroup$
$\endgroup$
4
-
$\begingroup$ Rule 1 of Crypto: Never roll your own. If there is already a thing that does what you want, why change it? $\endgroup$– MechMK1Feb 27, 2020 at 17:49
-
$\begingroup$ @MechMK1 I do not change it, I am just curious enough to ask the question. Plus, the idea of concatenating like that was taken from Monero paper getmonero.org/library/Zero-to-Monero-1-0-0.pdf, where Monero introduces their Ring Signature algorithm, they just concatenate difference component into Hash function and not using MAC. $\endgroup$– Pham Viet AnFeb 27, 2020 at 18:23
-
$\begingroup$ @Luc I am very sure and understand the difference between hash function and mac function. I just want to understand more in the particular case as I asked above. $\endgroup$– Pham Viet AnFeb 27, 2020 at 18:28
-
$\begingroup$ what do you mean by "difference"? they are two very different things used for different purposes. SHA-0 is very obsolete. $\endgroup$– dandavisFeb 27, 2020 at 19:00
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
With the capacity of SHA-3[1] against length extension, It doesn't need HMAC where the key is used twice to build a secure MAC. Instead one can design with prepending the message with the key. Actually, NIST already standardized this into The KECCAK Message Authentication Code KMAC.
With the fixed key and message size, your scheme can be considered as keyed MAC. There is one drawback in your case, the message length prohibits MAC arbitrary messages.
Also, your scheme has a collision where $\operatorname{SHA}(key_1\mathbin\|message_1)=(key_2\mathbin\| message_2)$[2] i.e. the key is used as the message and message as the key ($key_2 = message_1$ and $key_1 = message_2$).
Stick to standards. With KMAC you can MAC arbitrary lengths and have desired output lengths with the help of the cSHAKE128 (XOF - Extendable Output Functions) and have domain separation and even you request different output sizes for the same input, the output will be different.
[1] One can use Blake2 and Skein, too. Those are also resist to length extension attacks
[2] Here we assume that SHA is not SHA-1 or SHA-0. Also note that the SHA-512/256, SHA-512/224, SHA-384 have resistance to length extension attacks. Those are designedNIST after SHA3
answered Feb 27, 2020 at 21:29
-
$\begingroup$ What do you mean by "Also, your scheme have a collision where SHA(key_1||message_1)=(key_2,message_2) i.e. the key is uses as the message and message as the key.". I did not get this point. $\endgroup$ Feb 28, 2020 at 3:37
-
$\begingroup$ This sounds a little confusing. Also, the MAC idea works for any hash function which can be modeled as a random oracle. Not just SHA-3, but Blake and Skein as well. The reason why SHA-1, SHA-2, and MD5 aren't safe to use this way for variable length inputs is because they don't behave like a random oracle; which is the case because they are vulnerable to length extension; which is why you have to use something like HMAC instead of simple key concatenation. $\endgroup$ Feb 28, 2020 at 3:59
-