12

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define an offset from which 4 bytes are taken to be converted into a one time password.

Why can't the truncate function just always take the first 4 bytes of the HMAC? Is there some security implication of always taking the same 4 bytes that I have missed or is it just easier to implement using a dynamic offset?

Any information anyone could provide is greatly appreciated.

1
18

It is a bit of a fetish. As far as we currently know, there is no reason to believe that using the first four bytes of the HMAC output would not be equally secure.

However, lack of reason to believe does not imply that nobody believes. Some people "feel" that systematic truncation may help the attacker in some completely unspecified way. With a lot of handwaving, one might argue that the dynamic truncation will make the task a bit harder for an attacker who tries a brute force attack on the secret key, with the help of dedicated FPGA or ASIC:

  • Since all 20 output bytes may be needed, the attacker must compute a complete HMAC/SHA-1; if only the first four bytes were used, then a dedicated unrolled circuit might skip a few steps in the last SHA-1 rounds (we are talking about an optimization of, at best, 3% here).

  • The "dynamic truncation" implies some kind of data-dependent lookup, which can be expensive in hardware area (again, this is mostly negligible with regards to all the 32-bit adders in SHA-1).

But these are not, really, good reasons. So the main point of the "dynamic truncation" is to be some kind of crypto voodoo that may awe the neophyte, and thus possibly help in acceptance. Specifying a good algorithm is not enough; implementers must also be convinced to use it, and, for that, some magical-looking gestures can play wonders.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.