基于HMAC的新型消息认证方案：安全与效率
需积分: 10 107 浏览量
更新于2024-07-17
收藏 210KB PDF 举报
本文档《Keying Hash Functions for Message Authentication》主要探讨了在现代互联网应用和协议中广泛应用的基于哈希函数（如MD5或SHA）的消息认证机制。传统上，这些方法尽管易于实现，但往往缺乏严谨的安全分析，存在潜在的风险。
作者们提出了两种新的消息认证方案：NMAC (Nonce-based Message Authentication Code) 和 HMAC (Hash-based Message Authentication Code)，它们旨在克服现有技术的问题。这两个新设计的关键在于，它们的安全性直接依赖于底层的加密哈希函数，只要这个哈希函数具备一定的密码学强度，就能确保消息认证的安全性。
与传统的随机数或密钥绑定方法不同，NMAC和HMAC利用哈希函数的特性，提供了一种更为理论化且有保障的安全模型。它们不仅保证了安全，而且具有高效性和实用性，性能几乎等同于基础的哈希函数。这使得设计者可以像对待黑盒一样使用哈希函数，充分利用其已有的压缩功能，而不必深入了解其内部工作原理。
论文深入研究了这两种新型哈希函数消息认证方案的安全性质，并通过定量的方式表明，它们能保留底层哈希函数的大部分安全性。这意味着，即使在面临日益增长的攻击手段时，基于NMAC和HMAC的系统也能有效地抵御恶意篡改和伪造消息的尝试。
这篇论文的重要性在于，它不仅提供了更为坚实的安全基础，还推动了密码学领域的实践标准，为后续的网络通信和数据保护提供了更可靠的解决方案。此外，它也鼓励了进一步的研究，探索如何在保持高效的同时，进一步提升哈希函数在安全协议中的应用效能。
Keying Hash Functions for Message Authentication的研究成果对于保障网络通信的安全性和效率具有重要意义，对于从事信息安全、密码学和网络安全的从业人员来说，理解和掌握NMAC和HMAC的设计原则与特性是必不可少的。
Our analysis considers any generic attack on MAC schemes (rather than showing security against a
partial list of possible attacks) and shows that such an attack succeeds only if the underlying hash
function is weak. Moreover, this relation between the assumed properties of the hash function and
the security of the resultant MAC mechanism can be tightly quantified.
In summary, what this analysis says is that if significant weaknesses are ever found in the MAC
schemes proposed here, then not only does the underlying hash function need to be dropped from
these particular usages, but also it must be dropped from a wide range of other standard and
popular usages to which these functions are now subject. Moreover, our constructions require from
the hash function significantly weaker properties than standard collision-freeness. In particular,
current successful methods for finding collisions in MD5 [Do1, Do2] seem inapplicable to breaking
our schemes when the hash function in use is MD5 [Do3].
Efficiency. Our constructions use the cryptographic hash functions in a very simple way. In
particular, the performance degradation relative to the underlying hash scheme is minimal. This
is motivated by the use of these functions in basic applications like IP (Internet Protocol) security
[At1, At2] where the performance cost of such a function influences the computational and network
performance of many other applications.
Black box usage of hash functions. The constructions and analysis presented here are free
from any dependency on the peculiarities of the underlying hash function. We only exploit the
general structure of functions like MD5 and SHA-1, as being built on top of a basic compression
function which works on fixed length messages, and is then iterated multiple times in order to
process variable length inputs (see Section 2). Therefore, the underlying hash function (or the
corresponding compression function) can be seen as a module that can be easily replaced in case
serious weaknesses are found in the hash function, or when new (possibly, more secure or more
efficient) hash functions are designed. This replaceability property is fundamental given the limited
confidence earned so far by these functions.
2
Besides the security advantage, there is a practical advantage to MAC schemes that use the
underlying hash functions as a “black-box” (ie. by applying the hash function, or compression
function, “as is”, without any modifications). Namely such schemes permit the immediate use of
existing and widely available library code that implements these functions. They also permit use
of hardware-based implementations of the underlying hash scheme. Our NMAC construction uses
the compression function as a black-box; our HMAC construction, even more conveniently, uses
only calls to the iterated hash function itself.
1.4 A closer look
Before getting into the more technical aspects of the paper we further discuss our approach and
results.
Keying hash functions. The first obstacle that one faces when coming to design a MAC scheme
based on a cryptographic hash function (we limit ourselves, from now on, to “MD5-like” iterated
hash functions, as described above), is that the latter usually do not use any cryptographic key.
Rather, they are public functions that anyone can compute without the involvement of keys and
secrets. This is in sharp contrast to a MAC function, which uses a secret key as an inherent part of
its definition. Our approach to solve this problem is to key these hash functions through their initial
2
It is worth observing that in the case of message authentication, as opposed to encryption, the breaking of a
MAC does not compromise traffic authenticated in the past with the broken MAC. One can avoid the vulnerabilities
created by new attacks, by replacing the underlying hash scheme as soon as this is broken.
4
剩余18页未读，继续阅读
2021-04-10 上传
2019-08-15 上传
2020-04-29 上传
2019-08-16 上传
2018-01-13 上传
2021-06-04 上传
2021-10-26 上传
2021-09-14 上传
2022-07-14 上传
beebeeyoung
- 粉丝: 18
- 资源: 62
我的内容管理
展开
最新资源
- 前端协作项目：发布猜图游戏功能与待修复事项
- Spring框架REST服务开发实践指南
- ALU课设实现基础与高级运算功能
- 深入了解STK：C++音频信号处理综合工具套件
- 华中科技大学电信学院软件无线电实验资料汇总
- CGSN数据解析与集成验证工具集：Python和Shell脚本
- Java实现的远程视频会议系统开发教程
- Change-OEM: 用Java修改Windows OEM信息与Logo
- cmnd：文本到远程API的桥接平台开发
- 解决BIOS刷写错误28：PRR.exe的应用与效果
- 深度学习对抗攻击库：adversarial_robustness_toolbox 1.10.0
- Win7系统CP2102驱动下载与安装指南
- 深入理解Java中的函数式编程技巧
- GY-906 MLX90614ESF传感器模块温度采集应用资料
- Adversarial Robustness Toolbox 1.15.1 工具包安装教程
- GNU Radio的供应商中立SDR开发包：gr-sdr介绍
