Subject: RE: [Cfrg] Interim MAC function

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 17 Mar 2005 07:03:22 -0800

> If you know the K (which we do under your proposal) we can 
> calculate IV = H(K XOR ipad) (padding it to meet block 
> requirements if required) and then calculate our collision 
> for "M" (m1 & m2) based on that IV.

But k is a function of m1/m2 (k=sha1(m1)=sha1(m2)) if you change m1 or m2
you change k.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: Hugo Krawczyk <[email-masked]>
Date: Thu, 17 Mar 2005 20:17:23 +0200 (IST)

It seems that the proposal was
MASH(m)=HMAC-SHA1(K=SHA1(m), M=m)
(i.e. HMAC-SHA1 with message m and key SHA1(m))

If we ignore the opad/ipad padding of HMAC and the length-encoding
padding of SHA1 this becomes something like
H(H(m)|H(H(m)|m))
(where | stands for concatenation and H is SHA1 with length padding omitted).
Up to some IV replacemnt and assuming m to be a multiple
of 512 bits one has that H(H(m)|m) is "close" to H(m|m).
In this case we get that MASH(m) can be "approximated" by
H(H(m)|H(m|m)).

For the latter to be considered collision resistant one needs to assume
that finding collisions between two messages m,m' and alsso between m|m
and m'|m' is difficult.  I would not count on it.

But then again this is only an approximation.

Hugo