# Tag Info

0

If you trust $hash$ and the randomness of nonces and $K$ and its length, I do not see a particular issue with the simple version. (except one, I will return to this) It does allow any attacker to acquire $hash(K||x)$ for any chosen $x$ (unlike the "hardened" version) but considering that the attacker is able to sniff the traffic, they might have ...

0

You probably want to use HMAC instead of any hash function. I will use the notation $H(K, x)$ to denote a keyed MAC. Your simple protocol version seems to allow a reflection attack. First the adversary $A$ initiates a session with $B$: $A \to B$: $\mathrm{id}_A$, $n_A$ $B \to A$: $\mathrm{id}_B$, $n_B$, $H(K, n_A)$ Then $A$ initiates a second session with ...

1

(1) Yes, it would be a concern. Once upon a time, Dropbox did this. When synchronizing the files, it checked the hashes before uploading. Thus, if the file was already in their servers, they just linked it and the transfer was instantaneous. Then people started using it for sharing content. By having the hash of e.g. a movie, they could "claim" to ...

1

It's indeed a genuine concern. How to fight this? Well, once client had provided the SHA256 hash of the file (to quickly index the file on the server), your server then provide a random one-time key and ask the client to hash the file again with HMAC and the key. Since the key is one-time and random, adversaries have little chance at guessing the key and ...

1

In a practical sense you could use a HSM for this where an asymmetric (RSA) private key is stored. In at least some HSM's it is possible to set a maximum usage count. You could program a similar usage scenario within a smart card. The HSM and smart card then implement the trusted execution environment necessary for the question to be solved. So such tokens ...

Top 50 recent answers are included