Subject: Re: [TLS] padding bug

From: Peter Gutmann <[email-masked]>
Date: Wed, 11 Sep 2013 06:02:31 +0000

Nikos Mavrogiannopoulos <[email-masked]>

>Do you have any reference for that? RFC2104 and the paper it references 
>claim otherwise.

Oh man, that'd require ploughing through 15-year-old email discussions...
to see it in effect, look at section 2 of RFC 2402.

Peter.

---

From: "Blumenthal, Uri - 0558 - MITLL" <[email-masked]>
Date: Wed, 11 Sep 2013 14:23:27 -0400

>to see it in effect, look at section 2 of RFC 2402.

I see no presented evidence of having a clue.

There's nothing in RFC 2402 that would support your (unfounded)
speculation. On the other hand, section 6 of RFC 2402 refers to the two
mandatory-to-implement RFC 2403 (HMAC-MD5-96) and 2404 (HMAC-SHA-1-96).

RFC 2404 section 5 (Security Considerations, unsurprisingly), 4th
paragraph refers to RFC 2104 and explicitly mentions ADDITIONAL SECURITY
PROVIDED BY THE TRUNCATION OF THE RESULTING HASH.

Finally, RFC 2104 (HMAC) section 5 (Truncated output) describes the
cryptographic consequences of truncating the hash (less information on
hash result available to attacker vs. fewer bits to predict), with
reference to Preneel and Van Oorschot paper from Crypto'95 "Building fast
MACs from hash
           Functions".

Enough?