According to Wikipedia:

TLS has a variety of security measures:

Using a message digest enhanced with a key (so only a key-holder can check the MAC). The HMAC construction used by most TLS cipher suites is specified in RFC 2104 (SSL 3.0 used a different hash-based MAC).

What hash-based MAC did SSLv3.0 use? How does it compare to the ubiquitous HMAC that is used everywhere else today?

  • $\begingroup$ And did you up read the wiki page to the SSL 2.0/3.0 sections? $\endgroup$ – schroeder Sep 23 '20 at 14:54
  • $\begingroup$ @schroeder The section on SSL2.0 included this: SSL 2.0 had a weak MAC construction that used the MD5 hash function with a secret prefix, making it vulnerable to length extension attacks. Didn't seem to mention a specific protocol. $\endgroup$ – Eddie Sep 23 '20 at 15:04
  • $\begingroup$ And did you look up the RFC for the specifics? tools.ietf.org/html/rfc6101 $\endgroup$ – schroeder Sep 23 '20 at 15:09
  • $\begingroup$ The MAC is generated as: hash(MAC_write_secret + pad_2 + hash(MAC_write_secret + pad_1 + seq_num + SSLCompressed.type + SSLCompressed.length + SSLCompressed.fragment)) -- but this doesn't answer the second question... how does this compare to HMAC, why is one better or worse? $\endgroup$ – Eddie Sep 23 '20 at 16:04
  • 1
    $\begingroup$ @Eddie: A question about how the HMAC from TLS compares to the MAC of SSL 3.0 is better suited for Cryptography. $\endgroup$ – Steffen Ullrich Sep 23 '20 at 16:57

The key was concatenated in SSL 3.0:

    hash(MAC_write_secret + pad_2 +
         hash(MAC_write_secret + pad_1 + seq_num +
              SSLCompressed.type + SSLCompressed.length +

but XOR'ed in HMAC:

    H(K XOR opad, H(K XOR ipad, text))
  • $\begingroup$ Brilliant. Thank you. =) Can you speak to why the XOR is more secure than the concatenation, given the result is just going to be hashed? $\endgroup$ – Eddie Sep 23 '20 at 17:07
  • $\begingroup$ en.wikipedia.org/wiki/Length_extension_attack is the vulnerability. It let attackers add extra data without invalidating the hash. Most modern hash algorithms aren't vulnerable to this, so eg KMAC doesn't need the double hashing of HMAC. $\endgroup$ – SAI Peregrinus Sep 24 '20 at 2:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.