April 28, 2009, 9:03 PM
All April slides have been uploaded. I also added an optional reading related to Computer Forensics.
April 1, 2009, 10:20 AM
Before Thursday’s class, do the reading. Notable features:
- Textbook chapter is an overview, reading carefully before discussion will definitely help
- Amazon Web Services article is a great example of a simple flaw — canonicalizing a string (by sorting pieces of it) before hashing it leads to easy production of multiple strings that lead to the same hashed “signature”. We’ll discuss in class why string canonicalization happens in some protocols.
- Optional reading on HMAC construction gives more detail about the weaknesses that this design avoids — in particular “extension attacks”. The most trivial one to demonstrate is that if you defined a keyed MAC as hash(key||message), then anyone can figure out the the keyed MAC of any longer message without knowing the key.
Also, some short answers to the class discussion related to HMAC:
- Goal of HMAC is to add a keying feature to any MAC (hash) function. This construction doesn’t require specification of any additional encryption algorithm. So it’s all as simple and fast as the base MAC function.
- Keying with a separate encryption function works OK too. It’s just more complex to specify and to run.
- Encrypting before hashing is definitely slow.
- Encrypting after hashing is fine, though you have to specify behavior with regard to block sizes of hash and encryption functions. Doesn’t particularly accommodate variable-length key material (unless you hash that first too).
- The total algorithm description requires describing both the hash function and the encryption function and any other details about connecting them. It’s just messier than describing “HMAC-xxx” (where xxx is MD5, SHA1, SHA2, etc) which is both succinct and complete and simple to code for any MAC function.