3 ms·

More generally, a MAC. You don't necessarily need one based on a hash. (Unrelated) see also the more recent https://www.latacora.com/blog/2018/04/03/cryptogra

by loeg 2y ago

More generally, a MAC. You don't necessarily need one based on a hash. (Unrelated) see also the more recent https://www.latacora.com/blog/2018/04/03/cryptographic-right-answers/ https://www.latacora.com/blog/2018/04/03/cryptographic-right...

kccqzy 2y ago
Ah yes of course in 2018 it's still HMAC.
- JimDabell 2y ago
  They published a followup to that article two months ago, and the correct answer in 2024 is still HMAC. https://www.latacora.com/blog/2024/07/29/crypto-right-answers-pq/ https://www.latacora.com/blog/2024/07/29/crypto-right-answer...
  - tptacek 2y ago
    Who's "they"? This "right answers" thing is a meme (I ruefully share responsibility for it) that needs to die; Colin Percival has nothing to do with anything but the first one.
    - loeg 2y ago
      I linked to the older Latacora one upthread and this comment is linking to the newer Latacora one. So I think it's reasonable to read "they" as "Latacora" here.
      - tptacek 2y ago
        Yes, I wrote the older Latacora one, which was based on thing I wrote under my own name before I founded Latacora; I'm pretty sure I'm on solid ground saying Colin Percival had nothing to do with anything I wrote, since I wrote the first one as a rebuttal to Colin. (Did I misread you? Maybe we just agree.)
        loeg 2y ago
        I think we agree. I was only responding to the "Who's 'they'?" bit.
        tptacek 2y ago
        Sorry. I'm touchy about the cursed meme I helped create and also flinching at the idea that anything I wrote might get attributed to Colin. Definitely don't mean to jump down your throat.
        JimDabell 2y ago
        Yeah, just in the interests of clarity, somebody linked to the Latacora article “Cryptographic Right Answers” and I’d happened to read the updated Latacora article “Cryptographic Right Answers: Post Quantum Edition” a few hours beforehand, so I linked to it. “They” means Latacora, not Colin Percival.
        loeg 2y ago
        No problem.
notfed 2y ago
I'd also throw in that HMAC is overrated. It's a workaround for bad hash algorithms that are vulnerable to length-extension attacks. If you're using a "good" hash algorithm, then MAC-ing is simple: hash over your key and message. It's pretty weird that SHA-256 has been king for so long, when SHA-512/256 (which, as I've noticed people don't understand, means SHA-512 truncated to 256 bits) was there from the beginning and is immune from this attack. Anyway, in general it's a pet peeve of mine that many people so often say "HMAC" when really they just mean MAC.
- nmadden 2y ago
  Yes and no. HMAC is very inefficient for short messages, but that inefficiency quickly vanishes into noise for anything over a kB or two. (HKDF and HMAC-DRBG are probably the worst offenders as they are always running HMAC on small inputs). But, on the other hand, HMAC has repeatedly proven itself to be resilient to all kinds of attacks. I definitely didn’t mean any MAC when I recommended HMAC: eg I don’t think Poly1305 is a good general purpose MAC. PRF maybe, but sometimes you need the MAC to be committing too. Yes, some hash functions can be used with a simple prefix MAC, but then you need to list which specific hash functions to use (and most of those are not yet widely available).
- skrebbel 2y ago
  > It's pretty weird that SHA-256 has been king for so long, when SHA-512/256 (which, as I've noticed people don't understand, means SHA-512 truncated to 256 bits) was there from the beginning and is immune from this attack. A bit of a tangent, but I didn't know this, so thanks for pointing this out. It's insane to me that there's two SHA hash algorithms that result in a 256 bit string, named nearly identically, but the one is vulnerable to a length-extension attack but the other isn't. I had simply assumed that SHA-256 and SHA-512 are the exact same thing except the length of the result. Wouldn't anyone? The length of the result is right there in the name! I mean why does SHA-256 even exist when SHA-512/256 is what we should all use? Why does a single library implement an algorithm that everybody in crypto land, apparently (if you're right), already knew was broken from the start? Give the good one the short name and keep the bad one out of codebases! Come on! Crypto is hard but crypto people keep making it harder and I hate it.

by loeg 2y ago

kccqzy 2y ago

Ah yes of course in 2018 it's still HMAC.

JimDabell 2y ago
They published a followup to that article two months ago, and the correct answer in 2024 is still HMAC. https://www.latacora.com/blog/2024/07/29/crypto-right-answers-pq/ https://www.latacora.com/blog/2024/07/29/crypto-right-answer...
- tptacek 2y ago
  Who's "they"? This "right answers" thing is a meme (I ruefully share responsibility for it) that needs to die; Colin Percival has nothing to do with anything but the first one.
  - loeg 2y ago
    I linked to the older Latacora one upthread and this comment is linking to the newer Latacora one. So I think it's reasonable to read "they" as "Latacora" here.
    - tptacek 2y ago
      Yes, I wrote the older Latacora one, which was based on thing I wrote under my own name before I founded Latacora; I'm pretty sure I'm on solid ground saying Colin Percival had nothing to do with anything I wrote, since I wrote the first one as a rebuttal to Colin. (Did I misread you? Maybe we just agree.)
      - loeg 2y ago
        I think we agree. I was only responding to the "Who's 'they'?" bit.
        tptacek 2y ago
        Sorry. I'm touchy about the cursed meme I helped create and also flinching at the idea that anything I wrote might get attributed to Colin. Definitely don't mean to jump down your throat.
        JimDabell 2y ago
        Yeah, just in the interests of clarity, somebody linked to the Latacora article “Cryptographic Right Answers” and I’d happened to read the updated Latacora article “Cryptographic Right Answers: Post Quantum Edition” a few hours beforehand, so I linked to it. “They” means Latacora, not Colin Percival.
        loeg 2y ago
        No problem.

notfed 2y ago

I'd also throw in that HMAC is overrated. It's a workaround for bad hash algorithms that are vulnerable to length-extension attacks. If you're using a "good" hash algorithm, then MAC-ing is simple: hash over your key and message. It's pretty weird that SHA-256 has been king for so long, when SHA-512/256 (which, as I've noticed people don't understand, means SHA-512 truncated to 256 bits) was there from the beginning and is immune from this attack. Anyway, in general it's a pet peeve of mine that many people so often say "HMAC" when really they just mean MAC.

nmadden 2y ago
Yes and no. HMAC is very inefficient for short messages, but that inefficiency quickly vanishes into noise for anything over a kB or two. (HKDF and HMAC-DRBG are probably the worst offenders as they are always running HMAC on small inputs). But, on the other hand, HMAC has repeatedly proven itself to be resilient to all kinds of attacks. I definitely didn’t mean any MAC when I recommended HMAC: eg I don’t think Poly1305 is a good general purpose MAC. PRF maybe, but sometimes you need the MAC to be committing too. Yes, some hash functions can be used with a simple prefix MAC, but then you need to list which specific hash functions to use (and most of those are not yet widely available).
skrebbel 2y ago
> It's pretty weird that SHA-256 has been king for so long, when SHA-512/256 (which, as I've noticed people don't understand, means SHA-512 truncated to 256 bits) was there from the beginning and is immune from this attack. A bit of a tangent, but I didn't know this, so thanks for pointing this out. It's insane to me that there's two SHA hash algorithms that result in a 256 bit string, named nearly identically, but the one is vulnerable to a length-extension attack but the other isn't. I had simply assumed that SHA-256 and SHA-512 are the exact same thing except the length of the result. Wouldn't anyone? The length of the result is right there in the name! I mean why does SHA-256 even exist when SHA-512/256 is what we should all use? Why does a single library implement an algorithm that everybody in crypto land, apparently (if you're right), already knew was broken from the start? Give the good one the short name and keep the bad one out of codebases! Come on! Crypto is hard but crypto people keep making it harder and I hate it.