4

In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean?

Note: With MAC, I mean Message Authentication Code (as used in SSLv3), not Media Access Control !

1

Ad hoc simply means:

Ad hoc is a Latin phrase meaning "for this". It generally signifies a solution designed for a specific problem or task, non-generalizable, and not intended to be able to be adapted to other purposes.

In security, using ad-hoc protocols is usually a bad thing. There are (now) well defined well-analyzed MAC protocols; e.g., HMAC (hash-based MAC) defined as: HMAC(k, m) = H((k ^ opad) + H((k ^ ipad) ++ m)), where H is a hash function (e.g., SHA128), opad is a block long hexadecimal constant 5c5c5c...5c, ipad is a 363636...36, k is the shared secret key (used to generate and validate the MAC), ^ is XOR, + is concatenation.

In SSLv3, the MAC described in section 5.2.3.1 at first glance looks like a HMAC:

The MAC is generated as:

    hash(MAC_write_secret + pad_2 +
         hash(MAC_write_secret + pad_1 + seq_num +
              SSLCompressed.type + SSLCompressed.length +
              SSLCompressed.fragment));

 where "+" denotes concatenation.

 pad_1:  The character 0x36 repeated 48 times for MD5 or 40 times for SHA.
 pad_2:  The character 0x5c repeated 48 times for MD5 or 40 times for SHA.

but note XOR is never used -- its always concatenation. Note it is H(k + opad + H(k + ipad + m)). Furthermore, the MAC write secret k is simply MD5(master_secret + SHA('A' + master_secret + ServerHello.random + ClientHello.random)) in the case of MD5 being the hash. It's quite possible that these non-standard constructions leak information to very powerful attackers.

To quote this paper (Differences between SSLv2, SSLv3, and TLS (PDF)):

Ad hoc use of message authentication codes: there are MAC constructions that have not been subject to analysis such as HMAC. Wagner and Schneier don't have any specific objections to them but the point is valid: it's better to use something that has withstood a fair amount of analysis than something that hasn't, particularly in fielded systems.

Granted going back to Wagner and Schneier's paper (PDF), it seems that SSLv3 is just using an old version of HMAC that was obsolete in 1996:

SSL protects the integrity of application data by using a cryptographic MAC. The SSL designers have chosen to use HMAC, a simple, fast hash-based construction with some strong theoretical evidence for its security [BCK96]. In an area where several initial ad-hoc proposals for MACs have been cryptanalyzed, these provable security results are very attractive. HMAC is rapidly becoming the gold standard of message authentication, and it is an excellent choice for SSL. Barring major unexpected cryptanalytic advances, it seems unlikely that HMAC will be broken in the near future.

We point out the SSL 3.0 uses an older obsolete version of the HMAC construction. SSL should move to the updated current HMAC format when convenient for maximal security.

  • 2
    After reading your edits, can you please confirm the following statement, and what sources make you to do so : "ad hoc MAC" is a MAC which security has been unproved so far, contrary to HMAC. HMAC was first an ad Hoc MAC. – melostap May 7 '14 at 14:42
  • 1
    @melostap - I agree its never clearly defined as a combo term (and Weith calls it ad-hoc while W&S criticize SSLv3 for using obsolete-in-1996 version of HMAC). I'm not familiar with the full history of HMAC though it did first come out around then to combat against length extension attacks that MD5/SHA-1/SHA-2 are susceptible to. The first RFC draft for HMAC (March 1996) used xor with ipad / opad, which is easier to get provable security from. – dr jimbob May 7 '14 at 14:50
  • 2
    Well, I'm glad I'm not the only one to find it unclear. Unfortunately, that's exactly my question. I wish I could understand what they meant exactly, and I am still trying to dig it up without finding the answer. Maybe I should transfer the topic to CryptoStackExchange ? – melostap May 7 '14 at 14:55
  • @melostap - But I think we agree that ad hoc security is frowned upon - instead of being able to use all the cryptanalysis of HMAC (as defined in RFC2104), you have to specifically analyze the custom HMAC used in just SSLv3. Today, HMAC is well used as an acceptable MAC. With MD hashes (MD5, SHA1, SHA2), the hash is vulnerable to length extension attacks. For that reason alone, it seems less secure to concatenate an ipad / opad to a secret key to create effectively an independent key. Using xor appears to be much more sensible under this threat. – dr jimbob May 7 '14 at 14:58
  • 1
    could you detail a bit more in your answer what you call an "ad hoc security". What makes precisely a specific security as "ad hoc" ? – melostap May 7 '14 at 15:02
3

Ad-Hoc Communication is the process by which participating Nodes(Machines) can transfer data between them directly without a centralized server. MAC can refer to Medium Acces Control

MAC Code is a unique identification code assigned to devices communicating in adhoc mode to identify each other.
MAC can also refer to Message Authentication Code which is used to authenticate messages as well as to preserve integrity.Hashing and Encryption is used to achieve this.

So Adhoc MAC Means the Code used to authenticate messages between Nodes in an Adhoc network.

enter image description here

  • @melostap edited the answer. – techno May 7 '14 at 12:44
  • Watch this class.coursera.org/crypto-preview/lecture/22 and you may wait for others to correct me if my answer is incorrect :) – techno May 7 '14 at 12:59
  • 1
    I am afraid you didn't understood my question. It was in the sense of "dr jimbob" answer. But thank you anyway. – melostap May 7 '14 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.