Subject: Sorry, that's a digest, not a MAC RE: [Cfrg] Interim MAC function

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 16 Mar 2005 18:29:21 -0800

Sorry for the confusion, I was proposing a digest function, not a MAC. This
is what comes of not proofreading the subject line.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Hallam-Baker, Phillip
> Sent: Wednesday, March 16, 2005 9:18 PM
> To: 'Daniel Brown'; David Wagner
> Cc: [email-masked]; [email-masked]
> Subject: RE: [Cfrg] Interim MAC function
> 
> 
> 
> > From: [email-masked] [mailto:[email-masked]] On
> > Behalf Of Daniel Brown
> 
> > Because for long messages, the HMAC key is computed as
> > SHA-1(m), is that 
> > you what you're referring to?  Maybe the original intention 
> > was to modify 
> > HMAC to expand out the key the somehow.  Anyway, I agree with 
> > you that 
> > MASH - with a compacted key - is no more secure that SHA1 as 
> > a HASH, for 
> > the reason above. 
> 
> The precise proposal is to use 
> 
> MASH (m) = HMAC (m, (SHA (m))
> 
> Where HMAC (m, k) is the HMAC of message m with key k.
> 
> So the problem is to find
> 
> HMAC (m1, (SHA (m1)) = HMAC (m2, (SHA (m2))
> 
> If we find SHA (m1) = SHA (m2) the attacker still has to satisfy:
> 
> HMAC (m1, k) = HMAC (m2, k)
> 
> Which implies that
> 
> H(K XOR opad, H(K XOR ipad, m1)) = H(K XOR opad, H(K XOR ipad, m2))
> 
> 
> It may be possible to find such a condition but I certainly 
> do not believe that this follows as a direct result of SHA 
> (m1) = SHA (m2)
> 
> 
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
> 

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg