2

for instance, sha-1 is known as weak hash function. If attacker finds collision in hash function, can he generate valid MAC for given message m? I mean it is possible to generate valid mac for any message , just using weak hash function. If it possible, what is needed to generate valid mac?

1
  • I'm guessing you're talking about HMACs, and if so, no, finding a collision in a hash function isn't enough to generate a valid HMAC - you would need a collision between a hash, and that hash prepended with a specific other string, which you don't always know.
    – Matthew
    Sep 5, 2016 at 16:05

2 Answers 2

1

The prefixing hash collision vulnerabilities found in MD5 and SHA-1 do not undermine the security of an HMAC.

To put it simply: The security of the HMAC is dependent on a secret key and generating a collision isn't a shortcut. The attacker cannot generate the intended valid HMAC without knowledge of this secret key K- nor any other message input that would lead to the same output (e.g. a collision).

Additionally, the vulnerability found in MD5 and SHA-1 are prefixing attacks, and an attacker cannot control the prefix of the hash used in an HMAC due to an XOR operation, as shown in the diagram below:

enter image description here

1
  • That diagram is somehow harder to follow than HMAC(K, m) = H((K ⊕ opad) || H((K ⊕ ipad) || m)).
    – forest
    Jun 19, 2018 at 6:21
1

No, because the key acts as a bias adding just enough entropy to defeat the weakness. In the same way you can also still use HMACs based on md5. Obviously you shouldn't do so.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .