This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec.

In this spec, note the Rolling Proximity Identifier (RPI) is generated from the Daily Tracing Key and the TIN using HMAC.

My understanding is that the function to generate RPI only need to be a one-way function with deterministic output from a given input. Then why in this spec a HMAC is used instead of say a SHA256 function with N iteration?


I can only take a guess why they decided to implement this construct, but the first thing that comes to my mind are some security issues.

Using HMAC's prevents several possible attacks against SHA256. SHA256 uses a Merkle–Damgård construction, which is vulnerable to length extension attacks. Even when using SHA256(data||key), using a combination of the Daily Tracing Key and the TIN its much easier to find collisions.

So the RPI does not only need to be a one-way-function it also needs to have a good collision resistance.

Under Security Considerations it says:

Without the release of the Daily Tracing Keys, it is not computationally feasible for an attacker to find a collision on a Rolling Proximity Identifier. This prevents a wide-range of replay and impersonation attacks.

Using HMAC's therefore is more complex, but it mitigates or reduces those attack vectors.

If you're interested in the specification for HMAC's they are defined in RFC2104.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.