2

I recently learned about message authentication codes at uni and the lecturer said that it's important to use a padding to make the message an integer multiple of a certain length before hashing because otherwise "many" hash function allow data to be appended without changing the hash.

I didn't mishear that. It's on a lecture slide.

This lecture slide also shows this titled "actual implementation":

HMAC(Key, M) = H((Key ⊕ opad) ∥ H(Key ⊕ ipad ∥ M))

Meaning of the symbols:

M: message
H: cryptographic hash function
Key: symmetrical key
opad, ipad: inner/outer padding
∥: concatenation
⊕: XOR

First of all, I find the "actual implementation" rather awkward. That probably should be opad and ipad n times with n*length(opad) ≥ length(key) and n*length(ipad) ≥ length(key).

But mostly, I find that hard to believe and can't seem to find anything about it on the internet. Does this actually occur with cryptographic hash functions?

Improve this question

1 Answer 1

Reset to default
2

Are you referring to a Length Extension Attack?

In cryptography and computer security, a length extension attack is a type of attack where an attacker can use Hash(message1) and the length of message1 to calculate Hash(message1 ∥ message2) for an attacker-controlled message2. This attack can be used to sign a message when a Merkle–Damgård based hash is misused as a message authentication code, allowing for inclusion of extra information.

This attack can be done on hashes with construction H(secret ∥ message)1 when message and the length of secret is known. Algorithms like MD5, SHA-1, and SHA-2 that are based on the Merkle–Damgård construction are susceptible to this kind of attack.1[2][3] Note that since HMAC doesn't use the construction H(key ∥ message), HMAC hashes are not prone to length extension attacks.[4] The SHA-3 algorithm is not susceptible to this attack.[5]

Improve this answer
2
  • Thanks for that keyword. The lecture slide only says "Many hash functions allow extension of the hash by additionally appended data." but the lecturer said that data can be appended, leaving the hash the same.
    – UTF-8
    Commented Dec 25, 2016 at 13:01
  • The linked Wikipedia article says: "The message as fed into the hashing function is often padded, as many algorithms can only work on input messages whose lengths are a multiple of some given size." but the slide gives 2 "naive approaches" of defining HMAC: H(Key∥M) and H(M∥Key) which not only makes it even weirder because they don't have padding (should be added implicitly by the function, then, if necessary) but also because the attack described in the linked article only works if the key is prepended, not when it's appended. Besides: Hashing twice should already solve the problem.
    – UTF-8
    Commented Dec 25, 2016 at 13:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .