Another look at HMAC

Neal Koblitz; Alfred Menezes

Paper 2012/074

Another look at HMAC

Neal Koblitz and Alfred Menezes

Abstract

HMAC is the most widely-deployed cryptographic-hash-function-based message authentication code. First, we describe a security issue that arises because of inconsistencies in the standards and the published literature regarding keylength. We prove a separation result between two versions of HMAC, which we denote HMAC^{std} and HMAC^{Bel}, the former being the real-world version standardized by Bellare et al. in 1997 and the latter being the version described in Bellare's proof of security in his Crypto 2006 paper. Second, we describe how HMAC^{NIST} (the FIPS version standardized by NIST), while provably secure (in the single-user setting), succumbs to a practical attack in the multi-user setting. Third, we describe a fundamental defect from a practice-oriented standpoint in Bellare's 2006 security result for HMAC, and show that because of this defect his proof gives a security guarantee that is of little value in practice. We give a new proof of NMAC security that gives a stronger result for NMAC and HMAC and we discuss why even this stronger result by itself fails to give convincing assurance of HMAC security.

Note: --

Metadata

Available format(s): PDF
Category: Secret-key cryptography
Publication info: Published elsewhere. Also available at http://anotherlook.ca
Contact author(s): ajmeneze @ uwaterloo ca
History: 2013-04-24: last of 17 revisions; 2012-02-23: received; See all versions
Short URL: https://ia.cr/2012/074
License: CC BY

BibTeX

@misc{cryptoeprint:2012/074,
      author = {Neal Koblitz and Alfred Menezes},
      title = {Another look at {HMAC}},
      howpublished = {Cryptology {ePrint} Archive, Paper 2012/074},
      year = {2012},
      url = {https://eprint.iacr.org/2012/074}
}