Why you should never use hash functions for message authentication
1–10 of 103 posts
Re: Why you should never use hash functions for message authentication
#2The title is sort of linkbait, as in fact what it should be is "Never use hash functions vulnerable to extension attacks"... (And most common ones are) With that said, this stuff is pretty cool and after reading that the author learned all this in the Coursera Cryptography class I decided to sign up for it. (Starts June 11th)
Re: Why you should never use hash functions for message authentication
#3Number one thing I learned from the Coursera class: don't build your own crypto.
Re: Why you should never use hash functions for message authentication
#4Tl;dr: Use HMAC for Hash-based Message Authentication Codes and hash functions for hash functions. Don't use them the other way around.
PS, maybe more developers should take an intro course on crypto.
Re: Why you should never use hash functions for message authentication
#5For the string comparison, could you really use that in a timing attack. Wouldn't the difference between comparison taking one char longer be measured in nanoseconds, while the overall network lag would be milliseconds?
Re: Why you should never use hash functions for message authentication
#6> Finally, you should make sure your application does not exit early if the tag is invalid. You should do all the data processing you would normally do, just short of modifying the database, and check the tag last. If you return early you risk another timing attack.
What kind of timing attack is that? In order for there to be a timing attack, there has to be a difference in the timings.
1. You can either process the data, check the authentication code, then commit.
2. Or you can check the authentication code, process the data, then commit.
I don't see any attacks on #2 that couldn't also work on #1.
Re: Why you should never use hash functions for message authentication
#7The title is sort of linkbait, as in fact what it should be is "Never use hash functions vulnerable to extension attacks"... (And most common ones are) With that said, this stuff is pretty cool and after reading that the author learned all this in the Coursera Cryptography class I decided to sign up for it. (Starts June 11th)
You can learn all that and more just by reading Applied Cryptography.
Re: Why you should never use hash functions for message authentication
#8The title is sort of linkbait, as in fact what it should be is "Never use hash functions vulnerable to extension attacks"... (And most common ones are) With that said, this stuff is pretty cool and after reading that the author learned all this in the Coursera Cryptography class I decided to sign up for it. (Starts June 11th)
Although really, the maxim in the title is true. You should never use hash functions for authentication, you should use authentication codes.
As an analogy, you should never use a hammer to put in screws. That's not linkbait just because you have a tool that's a hammer on one end and a screwdriver on the other end.
Re: Why you should never use hash functions for message authentication
#9> Finally, you should make sure your application does not exit early if the tag is invalid. You should do all the data processing you would normally do, just short of modifying the database, and check the tag last. If you return early you risk another timing attack. What kind of timing attack is that? In order for there to be a timing attack, there has to be a difference in the timings. 1. You can either process the…
The timing attack is if you check the tag, that fails, and then you don't do any further request processing. This shortens the request time. It depends quite a lot on what you're actually doing with the message, but in general you want to leak as little info as possible about what's happening during any crypto-related process.
Re: Why you should never use hash functions for message authentication
#10> The easiest way to defeat this attack is, instead of directly comparing two strings, compare their mappings under a collision-resistant hash function.
Is this really the best way to compare strings without giving away timing info?