3 ms·
I think the point is that that is not necessarily true for all hash functions, since reordering your example with SHA1 renders it weaker. If I understood corre
by Skalman 13y ago
I think the point is that that is not necessarily true for all hash functions, since reordering your example with SHA1 renders it weaker.
If I understood correctly sha1(sha1(secret) + message) is not safe, because from that hash you can calculate sha1(sha1(secret) + message + ANYTHING)
- Mindless2112 13y agoSo why not sha1(sha1(secret) + sha1(message))? Or is that essentially an MAC?
- StavrosK 13y agoOne rule of thumb I've discovered: Whenever you say "why not X?", where "X" is some nonstandard construction, the answer is "because X is horribly broken in ways you can't even imagine".
- tptacek 13y agoFor one thing, you're incurring one more SHA1 invocation than you need; for another, you're clumsily duplicating HMAC, which has other security features (albeit not hugely practical ones). But the core feature of HMAC is indeed hashing the secret separately from the message.
- tptacek 13y agoCorrect; H(H(secret) || message) just scrambles the secret, but doesn't change the MAC construction.