0

From my research on using HMAC, it protects against length extension attacks on Merkle-Damgård hash algorithms. Is an HMAC only useful in the circumstance that the message syntax allows for lengthening and the key precedes the message when hashing?

If a server only accepts one command at a time, either "A", "B", or "C" such that a command "AB" or "AC" would not make any sense, then is there any concern with using H(KEY||A) (where H is a Merkle-Damgård digest) seeing as any length extension of that message would be a syntax error?

Also, wouldn't H(MESSAGE||KEY) also protect against length extension seeing as the legitimate receiver would try to authenticate H(MESSAGE1||MESSAGE2||KEY) but an attacker would only be able to calculate H(MESSAGE1||KEY||MESSAGE2)?

I'm not a cryptographer. I understand there may be purely academic attacks possible (say reducing brute force from a billion years to a million years), but are there any practical attacks possible that would allow for forged messages or recovery of the key in these instances?

drowsily.throbbing872
  • 21
  • 2
  • This is not a programming or development issue, and is offtopic for StackOverflow. It is ontopic for crypto.stackexchange.com, where at least https://crypto.stackexchange.com/questions/68502/have-there-been-efforts-to-prevent-length-extension-attacks- https://crypto.stackexchange.com/questions/25693/is-the-hmac-construction-really-neccessary-for-a-fixed-length-message https://crypto.stackexchange.com/questions/1186/is-hklengthx-a-secure-mac-construction are relevant, and nearly https://crypto.stackexchange.com/questions/2465/in-which-situations-is-a-length-extension-attack- and likely more. – dave_thompson_085 Jul 11 '23 at 08:59
  • Thanks. I thought this would be on topic since I was asking for practical attacks (meaning there would be coding involved). However I think this one essentially answered my question: https://crypto.stackexchange.com/questions/25693/is-the-hmac-construction-really-neccessary-for-a-fixed-length-message tl;dr - An HMAC is mathematically proven to be secure, my proposals have no proof. From the answer, "You don't have to use an HMAC, do it anyway." – drowsily.throbbing872 Jul 13 '23 at 15:12

0 Answers0