Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why you should never use hash functions for message authentication

blog.jcoglan.com

Post reply on HN
Print view View original

71–80 of 103 posts

Re: Why you should never use hash functions for message authentication

#71

Post by skibrah »

cjg wrote: post #36
Mithrandir wrote: post #3

Number one thing I learned from the Coursera class: don't build your own crypto.

I've heard this said many times before and I agree. However, using crypto libraries does not solve the problem of vulnerabilities through cryptography misuse. For example, keys must be stored correctly, algorithms often need initialising in the correct mode for your specific application, IVs must not be repeated, and, as shown in this article, hashes should be used in specific ways to work correctly. There are many w…

Agreed- you can take an intro course in crypto and still find many ways of getting it wrong. My intro to crypto professor reiterated this fact almost ever class and noted that even seemingly small changes to a protocol can render it vulnerable to attack.

Re: Why you should never use hash functions for message authentication

#72

Post by yuliyp »

jcoglan wrote: post #11
bemmu wrote: post #5

For the string comparison, could you really use that in a timing attack. Wouldn't the difference between comparison taking one char longer be measured in nanoseconds, while the overall network lag would be milliseconds?

You'd think that, but it is possible. Google "timing attacks over the internet".

I don't see string comparisons on tiny strings as feasible from either the Crosby/Wallach (suggests you need hundreds of nanoseconds of difference in execution time to be detectable) paper nor the Brumley/Boneh paper (which talks about a specific vulnerability in modular exponentiation which ends up revealing key details, not string comparison).

Re: Why you should never use hash functions for message authentication

#73

Post by waterlesscloud »

Mithrandir wrote: post #3

Number one thing I learned from the Coursera class: don't build your own crypto.

Just finished the class today myself, and yep, that's the most repeated advice.

The class repeats starting Monday, if anyone is interested in learning the basics of how all this stuff works.

https://www.coursera.org/course/crypto

Re: Why you should never use hash functions for message authentication

#74

Post by gav »

tptacek wrote: post #19
majormajor wrote: post #15

Earlier quoted context omitted.

But it only tells them that it failed, not that they got closer, like with the string-comparison based one. What does that gain an attacker if you already provide other feedback about the request being invalid? And not doing so would result in a bad user experience if you have users run into a bug somewhere and it fails silently so they don't know that nothing was actually done.

The leak that you're ostensibly timing is that in order to figure out how much of the candidate MAC string was valid, the target had to compare more byte, which takes more time, which adds observable lag to the error response.

Is the observable lag for a string comparison significant enough to be useful?

We're talking about such small amounts of time compared to the overhead of the full web stack.

Re: Why you should never use hash functions for message authentication

#75

Post by SoftwareMaven »

tptacek wrote: post #66
cjg wrote: post #36

Earlier quoted context omitted.

I've heard this said many times before and I agree. However, using crypto libraries does not solve the problem of vulnerabilities through cryptography misuse. For example, keys must be stored correctly, algorithms often need initialising in the correct mode for your specific application, IVs must not be repeated, and, as shown in this article, hashes should be used in specific ways to work correctly. There are many w…

This is the entire point of high-level crypto libraries, like Guttman's libcrypt and Google's Keyczar. So, yeah, don't use OpenSSL or javax::crypto or whatever .NET calls it; but, do consider using something like Keyczar, or, better yet, just use PGP/GPG to store data at rest, TLS for data in motion, and be done with it.

Those still require key management. There is no way a developer can abdicate all responsibility for this stuff, no matter how high level (at least, not until we have good, common, trusted security as a service).

Re: Why you should never use hash functions for message authentication

#76

Post by Mvandenbergh »

gav wrote: post #74
tptacek wrote: post #19

Earlier quoted context omitted.

The leak that you're ostensibly timing is that in order to figure out how much of the candidate MAC string was valid, the target had to compare more byte, which takes more time, which adds observable lag to the error response.

Is the observable lag for a string comparison significant enough to be useful? We're talking about such small amounts of time compared to the overhead of the full web stack.

The observable lag isn't usually significant enough if you only do it once but over many requests the stochastic factors can be compensated for.

Re: Why you should never use hash functions for message authentication

#77

Post by reitzensteinm »

gchpaco wrote: post #63
reitzensteinm wrote: post #62

Earlier quoted context omitted.

What's wrong with simply doing a traditional compare, but not exiting early when it's found the two strings don't match? I see how the xor method works, but not why it's superior. Also, it would seem that you'd be leaking information about the size of the other string with either method (whether you exit early or not when you run past the length of one of the strings) - not a problem when comparing hashes presumably,…

Compiler optimizations, CPU pipeline and branch prediction would be my guess, although I'm sure someone else can jump in with more detail. XOR is basically immune to optimized tricks.

Ah, that does make sense. Thanks!

Re: Why you should never use hash functions for message authentication

#79

Post by tptacek »

SoftwareMaven wrote: post #75
tptacek wrote: post #66

Earlier quoted context omitted.

This is the entire point of high-level crypto libraries, like Guttman's libcrypt and Google's Keyczar. So, yeah, don't use OpenSSL or javax::crypto or whatever .NET calls it; but, do consider using something like Keyczar, or, better yet, just use PGP/GPG to store data at rest, TLS for data in motion, and be done with it.

Those still require key management. There is no way a developer can abdicate all responsibility for this stuff, no matter how high level (at least, not until we have good, common, trusted security as a service).

Part of the point of Keyczar (note the name) is to make the right decisions about key management in advance and abstract them away from developers.

Re: Why you should never use hash functions for message authentication

#80

Post by [deleted] »

threedaymonk wrote: post #53
pbsd wrote: post #50

Earlier quoted context omitted.

"Never use a hash function for message authentication" is such a simplistic view. The author takes a common hash function design (Merkle-Damgard), and somehow extrapolates that hash functions should be simply ruled out for authentication. First, this may send the wrong message to the less-focused reader: "what, I should use block ciphers instead?". Luckily, HMAC is eventually brought up, which is a fine solution. HMA…

First, this may send the wrong message to the less-focused reader: "what, I should use block ciphers instead?". Luckily, HMAC is eventually brought up, which is a fine solution. If the reader can't be bothered to read the article to the end, I hardly think it reflects on the author. Whilst it might indeed be a more concise article if it just said "don't use a hash function for message authentication, use HMAC", it wo…

[deleted]
Post reply on HN