基于HMAC的新型消息认证方案：安全与效率

需积分: 10 145 浏览量更新于2024-07-17 收藏 210KB PDF 举报

本文档《Keying Hash Functions for Message Authentication》主要探讨了在现代互联网应用和协议中广泛应用的基于哈希函数（如MD5或SHA）的消息认证机制。传统上，这些方法尽管易于实现，但往往缺乏严谨的安全分析，存在潜在的风险。作者们提出了两种新的消息认证方案：NMAC (Nonce-based Message Authentication Code) 和 HMAC (Hash-based Message Authentication Code)，它们旨在克服现有技术的问题。这两个新设计的关键在于，它们的安全性直接依赖于底层的加密哈希函数，只要这个哈希函数具备一定的密码学强度，就能确保消息认证的安全性。与传统的随机数或密钥绑定方法不同，NMAC和HMAC利用哈希函数的特性，提供了一种更为理论化且有保障的安全模型。它们不仅保证了安全，而且具有高效性和实用性，性能几乎等同于基础的哈希函数。这使得设计者可以像对待黑盒一样使用哈希函数，充分利用其已有的压缩功能，而不必深入了解其内部工作原理。论文深入研究了这两种新型哈希函数消息认证方案的安全性质，并通过定量的方式表明，它们能保留底层哈希函数的大部分安全性。这意味着，即使在面临日益增长的攻击手段时，基于NMAC和HMAC的系统也能有效地抵御恶意篡改和伪造消息的尝试。这篇论文的重要性在于，它不仅提供了更为坚实的安全基础，还推动了密码学领域的实践标准，为后续的网络通信和数据保护提供了更可靠的解决方案。此外，它也鼓励了进一步的研究，探索如何在保持高效的同时，进一步提升哈希函数在安全协议中的应用效能。 Keying Hash Functions for Message Authentication的研究成果对于保障网络通信的安全性和效率具有重要意义，对于从事信息安全、密码学和网络安全的从业人员来说，理解和掌握NMAC和HMAC的设计原则与特性是必不可少的。

Our analysis considers any generic attack on MAC schemes (rather than showing security against a

partial list of possible attacks) and shows that such an attack succeeds only if the underlying hash

function is weak. Moreover, this relation between the assumed properties of the hash function and

the security of the resultant MAC mechanism can be tightly quantiﬁed.

In summary, what this analysis says is that if signiﬁcant weaknesses are ever found in the MAC

schemes proposed here, then not only does the underlying hash function need to be dropped from

these particular usages, but also it must be dropped from a wide range of other standard and

popular usages to which these functions are now subject. Moreover, our constructions require from

the hash function signiﬁcantly weaker properties than standard collision-freeness. In particular,

current successful methods for ﬁnding collisions in MD5 [Do1, Do2] seem inapplicable to breaking

our schemes when the hash function in use is MD5 [Do3].

Efficiency. Our constructions use the cryptographic hash functions in a very simple way. In

particular, the performance degradation relative to the underlying hash scheme is minimal. This

is motivated by the use of these functions in basic applications like IP (Internet Protocol) security

[At1, At2] where the performance cost of such a function inﬂuences the computational and network

performance of many other applications.

Black box usage of hash functions. The constructions and analysis presented here are free

from any dependency on the peculiarities of the underlying hash function. We only exploit the

general structure of functions like MD5 and SHA-1, as being built on top of a basic compression

function which works on ﬁxed length messages, and is then iterated multiple times in order to

process variable length inputs (see Section 2). Therefore, the underlying hash function (or the

corresponding compression function) can be seen as a module that can be easily replaced in case

serious weaknesses are found in the hash function, or when new (possibly, more secure or more

eﬃcient) hash functions are designed. This replaceability property is fundamental given the limited

conﬁdence earned so far by these functions.

Besides the security advantage, there is a practical advantage to MAC schemes that use the

underlying hash functions as a “black-box” (ie. by applying the hash function, or compression

function, “as is”, without any modiﬁcations). Namely such schemes permit the immediate use of

existing and widely available library code that implements these functions. They also permit use

of hardware-based implementations of the underlying hash scheme. Our NMAC construction uses

the compression function as a black-box; our HMAC construction, even more conveniently, uses

only calls to the iterated hash function itself.

1.4 A closer look

Before getting into the more technical aspects of the paper we further discuss our approach and

results.

Keying hash functions. The ﬁrst obstacle that one faces when coming to design a MAC scheme

based on a cryptographic hash function (we limit ourselves, from now on, to “MD5-like” iterated

hash functions, as described above), is that the latter usually do not use any cryptographic key.

Rather, they are public functions that anyone can compute without the involvement of keys and

secrets. This is in sharp contrast to a MAC function, which uses a secret key as an inherent part of

its deﬁnition. Our approach to solve this problem is to key these hash functions through their initial

It is worth observing that in the case of message authentication, as opposed to encryption, the breaking of a

MAC does not compromise traﬃc authenticated in the past with the broken MAC. One can avoid the vulnerabilities

created by new attacks, by replacing the underlying hash scheme as soon as this is broken.

剩余18页未读，继续阅读

beebeeyoung

粉丝: 17
资源: 62

基于HMAC的新型消息认证方案：安全与效率

Probability_and_Statistics_for_Engineers.pdf

论文研究-High-speed polarization-shift keying: experimental and numerical investigation.pdf

无线电信号识别调制技术深度学习原理举几个数字调制的例子

调制采用ASK、FSK、PSK、DPSK调制的优点

ask fsk psk matlab

ad9854 SHAPED KEYING端口

binary frequency shift keying

配置完打包报错 EBUSY: resource busy or locked, rmdir 'C:\Users\keying\Desktop\website-one\.output\public'

matlab调制与解调

QPSK（Quadrature Phase Shift Keying）的解调方式有以下几种

最新资源