I have a secret key
k and message
m. I send
m || HMAC(m, k) to some other party, who can verify the integrity of m, assuming that they know
Suppose I have multiple messages
m2, and so on. Which of the following two constructions is better from an overall security perspective:
m1 || HMAC(m1, k) || m2 || HMAC(m1 || m2, k) || ...
m1 || HMAC(m1, k) || m2 || HMAC(m2, k) || ...
Obviously, I will not need to actually concatenate
m1 || m2 to generate
HMAC(m1 || m2, k). I simply continue using the state of the HMAC as more and more messages are signed. So the first mode of operation is actually more efficient and what I would prefer to use. In the second case, I have to reset HMAC state prior to the next message.
As far as the receiver is concerned, the first time message authentication fails, that's the end of the conversation. So I don't gain anything by having a valid HMAC for
m1 could not be authenticated.
Is one of the constructions inherently more secure than the other? Could the first mode of operation leak any information about the key (theoretically)?