for instance, sha-1 is known as weak hash function. If attacker finds collision in hash function, can he generate valid MAC for given message m? I mean it is possible to generate valid mac for any message , just using weak hash function. If it possible, what is needed to generate valid mac?
1
-
I'm guessing you're talking about HMACs, and if so, no, finding a collision in a hash function isn't enough to generate a valid HMAC - you would need a collision between a hash, and that hash prepended with a specific other string, which you don't always know.– MatthewCommented Sep 5, 2016 at 16:05
Add a comment
|
2 Answers
The prefixing hash collision vulnerabilities found in MD5 and SHA-1 do not undermine the security of an HMAC.
To put it simply: The security of the HMAC is dependent on a secret key and generating a collision isn't a shortcut. The attacker cannot generate the intended valid HMAC without knowledge of this secret key K- nor any other message input that would lead to the same output (e.g. a collision).
Additionally, the vulnerability found in MD5 and SHA-1 are prefixing attacks, and an attacker cannot control the prefix of the hash used in an HMAC due to an XOR operation, as shown in the diagram below:
-
That diagram is somehow harder to follow than HMAC(K, m) = H((K ⊕ opad) || H((K ⊕ ipad) || m)).– forestCommented Jun 19, 2018 at 6:21
No, because the key acts as a bias adding just enough entropy to defeat the weakness. In the same way you can also still use HMACs based on md5. Obviously you shouldn't do so.
