4 ms·
> You can't just do SHA256(key + message) to generate a safe MAC. Can you explain this?
by staticassertion 5y ago
> You can't just do SHA256(key + message) to generate a safe MAC.
Can you explain this?
- dagenix 5y agoA Sha256 hash is just a dump of the internal state of the function. If you know the hash, you can keep running the hash function for more data and calculate a new hash for the original data with new data appended.
- maqp 5y agoWhat @dagenix said. See e.g. Thomas Pornin's answer here https://crypto.stackexchange.com/a/3979 https://crypto.stackexchange.com/a/3979 for more details
- stouset 5y agoIf you have the output h = SHA-256(k || m1) you can easily compute a function `F(h, m2)` such that SHA-256(k || m1 || m2) = F(h, m2) allowing you to forge a verifier for `m1 || m2` under `k` for any `m2` you wish without actually knowing `k`.