Subject: [Cfrg] Re-examine HMAC for non-MAC uses?

From: Dan Brown <[email-masked]>
Date: Tue, 12 Apr 2016 20:21:58 +0000

>From http://eprint.iacr.org/2016/360

"Aside from the issue of the tightness gaps, there is another fundamental reason why the
theorems in [12, 14, 57] about security of NMAC and HMAC under the PRF-assumption
offer little practical assurance. To the best of our knowledge, the PRF-assumption has never
been seriously studied for the compression functions used in MD5, SHA1, or SHA256; in
fact, we are not aware of a single paper that treats this question. Moreover, when those compression
functions were constructed, the PRF-property was not regarded as something that
had to be satisfied - rather, they were constructed for the purpose of collision-resistance
and pre-image resistance. Thus, in the case of the concrete hash functions used in practice,
we have no evidence that could rule out attacks on the PRF-property

...

We conclude this section with a recommendation. Standards bodies should reexamine
- taking into account tightness gaps - the security of all standardized protocols that use
HMAC for non-MAC purposes such as key derivation or passwords. The same should be
done for HMAC-protocols using hash functions such as MD5 or SHA1 that are not believed
to have weak collision-resistance in the sense of [17]."

Do some (newly proposed and amendable) IETF protocols still use HMAC for key derivation, e.g. TLS (via HKDF)?  If so, then should CFRG, per the academic recommendation above, re-examine such usage?  I've occasionally wondered similar things, but I do not yet have any clear thoughts on the issue.
 
Best regards,

Daniel Brown
Research In Motion Limited