1
$\begingroup$

Consider an HMAC algorithm that uses SHA-512 with an unknown private key. Is it possible to affect its output, either partially or totally, by providing it with carefully crafted messages?

For the purposes of this question, consider that the application "updates" its state using our hand-crafted message plus a string that changes on each request which is also known to us. Additionally, consider that we are able to ask the service to sign for us an arbitrary number of messages.

$\endgroup$
2
  • $\begingroup$ Do you mean, attack during calculation? Why not steal the key? $\endgroup$ – kelalaka May 14 '20 at 0:35
  • $\begingroup$ You can assume that the key is securely guarded @kelalaka. The algorithm only utilizes the first 7 bytes, a.k.a. 56-bits, of the output of the algorithm, so being able to affect those first 7 bytes in any way would answer my question. Is HMAC susceptible to timing attacks? $\endgroup$ – Alex Papageorgiou May 14 '20 at 7:46
1
$\begingroup$

Consider an HMAC algorithm that uses SHA512 with an unknown private key. Is it possible to affect its output, either partially or totally, by providing it with carefully crafted messages?

Sure, however you will get totally unrelated HMAC output even if you change (or add or remove) even a single bit from the HMAC input. So each bit flips with a 50% certainty. Creating "crafted messages" doesn't have any effect on this property.

If you are looking for a specific output then you won't be able to get it, assuming that at least, say 64, bits of HMAC output is kept (if that's the case you might try and brute force). Similarly for other properties, the outcome of HMAC is totally dependent on chance if you don't know the key and /or input message.

$\endgroup$
4
  • $\begingroup$ If one considers that the algorithm keeps only the first 7 bytes of the output, would it be possible to know any of these 7 bytes of a specific message prior to requesting the HMAC be generated? $\endgroup$ – Alex Papageorgiou May 14 '20 at 7:43
  • $\begingroup$ No, that's not possible. You can just try and hope you hit some kind of value. Generally that's not very useful, but I thought I'd mention it anyway. $\endgroup$ – Maarten Bodewes May 14 '20 at 11:28
  • $\begingroup$ I see, thanks a lot! By "hoping to hit some kind of value" I assume you mean at complete randomness, right? $\endgroup$ – Alex Papageorgiou May 14 '20 at 12:03
  • $\begingroup$ Yeah, exactly. Well, indistinguishable from random anyway. $\endgroup$ – Maarten Bodewes May 14 '20 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.