I'm in the process of developing a system that periodically transmits a small amount of data (16/18 bytes), where the only part that will change is a 4 byte counter that will increment for each transmission. The data itself is not sensitive, so encryption it's not mandatory, but the receiver must validate the data using a MAC algorithm, HMAC-SHA was my choice. Given the fact that, for successive transmissions, only few bits of the data payload will change (the counter increment), is it safe to use HMAC-SHA without data encryption or this kind of implementation could lead an attacker to generate false MACs?

  • SHA1? Are you aware that SHA1 is considered to be relatively weak? en.wikipedia.org/wiki/SHA-1#Attacks – Steve Sether Jan 14 '16 at 18:21
  • 2
    @SteveSether No serious weaknesses have been found in HMAC-MD5 nor HMAC-SHA1 so far, afaik. This might be explained by the fact that HMAC has been proven to be secure when the underlying cryptographic hash function is weakly collision-resistant. – bayo Jan 14 '16 at 19:31
  • @bayo15 But the question is still why use a component that's been shown to be weak? Wouldn't it be preferable to use an underlying hash that hasn't shown any weaknesses? – Steve Sether Jan 14 '16 at 19:34
  • @SteveSether What I was saying is that so far found weaknesses in SHA1 do not imply any weakness in HMAC-SHA1. There might be various reasons to use HMAC-SHA1 and the fact that SHA1 is considered weak in some ways is no valid argument to use a different underlying algorithm. Anyway, this is getting off-topic so we might consider to stop this discussion in this very comment section. – bayo Jan 14 '16 at 19:41

For establishing the message integrity, yes, HMAC-SHA should be fine.

The one concern you might have is in the case of a man-in-the-middle attack where the message might be intercepted, the counter changed, the HMAC regenerated and the modified message passed on to the original recipient. In this case you could look at using a public key algorithm to sign the HMAC hash(effectively a digital signature) to authenticate the sender.

Edit: not a concern unless your keys get into the wrong hands.

|improve this answer|||||
  • 4
    How can the HMAC be calculated by the MiTM unless they have the secret, in which case you've been hacked? – Neil Smithline Jan 14 '16 at 15:39
  • 2
    You're absolutely right, I'll fix my answer. – Whome Jan 14 '16 at 15:45

Attacks on encryption are not attacks on MACs as they are two separate entities for different purposes. You kind of answered the question yourself. Since you don't consider the data sensitive to sniffing then you don't require encryption.

However for a MAC you do run into the following issues that may require encrypting other data:

  1. key-sharing: sharing the "key" that produces the hash

  2. proving to a third party (non-repudiation) that the data or the asymmetric key in #1 did come from you and not the person you are sending data to. Since they can now impersonate you with the key shared with them ... MACs have a symmetric nature as it is a "keyed"-hash

To solve #1 asymmetric encryption is required to transfer the keys that are used to HMAC the data. To solve #2 and/or verify the asymmetric key in #1 some PKI must be set up, be it certs or a Web of trust.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.