2 ms·
It is fairly well-studied; it's called chopMD in the literature. It has been shown to be indifferentiable from a random oracle [1, Theorem 3], provided enough b
by pbsd 13y ago
It is fairly well-studied; it's called chopMD in the literature. It has been shown to be indifferentiable from a random oracle [1, Theorem 3], provided enough bits are chopped.
[1] http://www.cs.nyu.edu/~puniya/papers/merkle.pdf http://www.cs.nyu.edu/~puniya/papers/merkle.pdf
- JoachimSchipper 13y agoThanks for pointing me at those papers! I'll admit it's been studied more than I thought. (I was actually more worried about cryptanalytic attacks - the construction itself is obviously secure when instantiated with a random oracle - but I don't really see how that would work either. I maintain that it's ugly, but HMAC isn't the nicest construction in the world either, I suppose...)
- pbsd 13y agoI suppose there is some CYA value in HMAC, since there is less attacker control over what goes in the outer hash. If the case is that prefix-MAC (with chopMD) is vulnerable to some kind of cryptanalysis and HMAC is not, however, the hash should be considered broken, and not in the academic sense.
- JoachimSchipper 13y agoYou're completely right, but it's not like people have transitioned off of SHA-1 (Wikipedia: "As of 2012, the most efficient attack against SHA-1 is considered to be the one by Marc Stevens with an estimated cost of $2.77M to break a single hash value by renting CPU power from cloud servers"; note that renting cloud server time is not a sensible way to approach this problem). Or even MD5.