4 ms·
I think what he is saying is that we can get lucky in guessing the correct hash even if we guessed the value wrong. b can only be picked once, and we transmit
by RyanZAG 14y ago
I think what he is saying is that we can get lucky in guessing the correct hash even if we guessed the value wrong.
b can only be picked once, and we transmit g^b
Attacker then needs to guess a g^a that will cause hmac(g^ab) to match. So we might guess an incorrect g^a that still manages to collide and give us the correct hmac.
This apparently close to doubles our chance of guessing correctly? Depending on the properties of hmac this sounds reasonable, but still doesn't affect security much, as he says - it would still be 1/2^{16} - not likely to happen.