Cryptology ePrint Archive: Report 2018/097
Exploiting an HMAC-SHA-1 optimization to speed up PBKDF2
Andrea Visconti and Federico Gorla
Abstract: PBKDF2 [27] is a well-known password-based key derivation function. In order to slow attackers down, PBKDF2 introduces CPU-intensive operations based on an iterated pseudorandom function (in our case HMAC-SHA-1). If we are able to speed up a SHA-1 or an HMAC implementation, we are able to speed up PBKDF2-HMAC-SHA-1. This means that a performance improvement might be exploited by regular users and attackers. Interestingly, FIPS 198-1 [31] suggests that it is possible to precompute first message block of a keyed hash function only once, store such a value and use it each time is needed [43]. Therefore the computation of first message block does not contribute to slowing attackers down, thus making the computation of second message block crucial. In this paper we focus on the latter, investigating the possibility to avoid part of the HMAC-SHA-1 operations. We show that some CPU-intensive operations may be replaced with a set of equivalent, but less onerous, instructions. We identify useless XOR operations exploiting and extending Intel optimizations [26], and applying the Boyar-Peralta heuristic [12]. In addition, we provide an alternative method to compute the SHA-1 message scheduling function and explain why attackers might exploit these findings to speed up a brute force attack.
Category / Keywords: HMAC-SHA-1; Password-Based Key Derivation Function 2; PKCS#5; Intel optimizations; Boyar-Peralta heuristic
Date: received 26 Jan 2018
Contact author: andrea visconti at unimi it
Available format(s): PDF | BibTeX Citation
Version: 20180128:214235 (All versions of this report)
Short URL: ia.cr/2018/097
Discussion forum: Show discussion | Start new discussion
[ Cryptology ePrint archive ]