0
$\begingroup$

I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash block long (i.e., 512 bits), and nopad means that padding is disabled.

This seems to me to be equivalent in security to truncate8(SHA256(IV=standard, secret||message)), except that it is about twice as fast. This makes me suspicious that it might not be as secure, hence this question.

Is there a real reason to use HMAC in my use case where the message is always one hash block long?

$\endgroup$
8
  • 1
    $\begingroup$ IV = secret is really not possible. An IV is supposed to be public and should always change; so you just have a secret. Other issues are the size of the secret size is unknown to us, and that the combination of secret and message is unknown - I guess we can assume concatenation? Because SHA-256 takes just one parameter: a message. 64 bits is generally assumed to weak, even if it is an authentication tag. Finally, without the IV a replay attack seems very feasible. $\endgroup$
    – Maarten Bodewes
    May 17 '21 at 14:23
  • $\begingroup$ @MaartenBodewes By IV=secret, I mean that SHA-256 is modified in the MAC generator/checker to start with a randomly-chosen value known only to the MAC generator/checker instead of its usual (publicly-known) IV. $\endgroup$
    – Guest
    May 17 '21 at 14:25
  • $\begingroup$ Well, randomly chosen doesn't seem to be a good idea (how would you communicate the random value?), but you could use a ratchet or other key derivation procedure. What's the size of the secret? Note that one hash block still gets padded with the length and at least one padding byte. $\endgroup$
    – Maarten Bodewes
    May 17 '21 at 14:27
  • $\begingroup$ @MaartenBodewes There is no need to communicate the random value, it is just stored in, let's say, "the server". The secret would be the size of the IV for SHA-256, which I believe is the same size as the digest, so 256-bit. Ah, I should also have mentioned the padding is disabled in my variant of SHA-256, will update post. $\endgroup$
    – Guest
    May 17 '21 at 14:33
  • $\begingroup$ @MaartenBodewes: they're using the 'secret IV' as the MAC key. Communicating it is no harder (and no easier) than communicating any other MAC key. $\endgroup$
    – poncho
    May 17 '21 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.