Subject: RE: [Cfrg] security of HMAC

From: "Doug Whiting" <[email-masked]>
Date: Wed, 19 Jul 2006 11:33:00 -0700

One further note: per table 3, the 34-round (out of 80) attack also
apparently requires 2**53 chosen plaintexts.  In practice, this means
that the attack (as currently formulated) is of little concern, even if
it were getting close to a full-round attack, which it is not. For
example, in typical IPsec, a session never has more than 2**32 messages,
and good cryptographic practice probably requires re-keying much more
frequently anyway (once per year would do).

Of course, attacks always get better over time, so as always we should
keep on the lookout for improvements, but I'll note that there are
well-known seven  round (out of ten) attacks on AES-128 and nobody's
panicking.  Unless this attacks gets improved a whole lot, there is no
need worry about HMAC-SHA1 (or probably even HMAC-MD5), imo.

> -----Original Message-----
> From: Scott Fluhrer [mailto:[email-masked]] 
> Sent: Wednesday, July 19, 2006 10:20 AM
> To: Daniel Brown
> Cc: [email-masked]
> Subject: Re: [Cfrg] security of HMAC
> 
> 
> 
> On Wed, 19 Jul 2006, Daniel Brown wrote:
> 
> > Scott Fluhrer <[email-masked]> wrote on 07/18/2006 06:59:14 PM:
> >
> >>
> >> On Tue, 18 Jul 2006, Daniel Brown wrote:
> >>
> >>> Is it correct that the first paper is claiming to be able forge
> > HMAC-SHA1
> >>> with work effort 2^53?
> >>
> >> No, the results in table 3 claims the 2^53 forgery result 
> applies to 
> >> a reduced round version of SHA-1 (34 rounds, rather than 
> the full 80).
> >>
> >> This appears to be an impressive result, but it is not a 
> cause to panic.
> >>
> >
> > Thanks, I didn't read it right at all (and guess I panicked 
> when I saw 
> > 80 rounds in the left column and mistakenly took it to mean 
> how many 
> > rounds were being attacked).
> >
> > Anyway, I still ask: is this result any cause to accelerate 
> migration 
> > away from HMAC-MD4/SHA1 (without panicking)?
> 
> You, of course, meant to type HMAC-MD5 -- this paper would 
> give ample justification for moving away from HMAC-MD4, had 
> anyone in the IETF been silly enough to use it.
> 
> >                                         For example, should 
> new IETF 
> > specifications allow HMAC-MD5/SHA1 only for backwards 
> interop purposes?
> > This impressive result seems to establish an erosion in the 
> security 
> > of the HMAC that heretofore HMAC was thought to be free from, so it 
> > should be at least be considered when choosing a MAC.
> 
> My opinion is that it isn't.  After all, the version they 
> attacked was severely weakened; less than half the rounds.  
> An equivilent result against 128 bit AES would be against a 
> four round version.  We already have results against AES 
> reduced to four rounds, no one is seriously concerned that 
> that result implies that we should migrate from AES.
> 
> -- 
> scott
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
> 
> 

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg