SHA-3增强HMAC安全：RSA会议上Sponge构造的分析
25 浏览量
更新于2024-07-15
收藏 211KB PDF 举报
本文主要探讨了在SHA-2基础上替换为SHA-3对HMAC（Hash-based Message Authentication Code）的安全性提升，特别是在MAC（Message Authentication Code）和PRF（Pseudorandom Function）安全性的理论分析。SHA-3被引入HMAC的设计中，具体表现为基于Sponge构造的HMAC，即Sponge-based HMAC。
研究者首先针对Sponge-based HMAC进行了深入研究。他们提供了关于该构造的MAC安全性和PRF安全性的近似最优上界，分别是O(nq^2^n)和O(q^2^(2n))，其中n是哈希函数的输出长度，q是HMAC接收到的消息查询次数。这些结果表明，使用SHA-3构建的HMAC在安全性方面具有显著优势，尤其是在面对大量查询时。
接下来，文章将SHA-3-based HMAC与SHA-2为基础的两种常见HMAC构造进行了对比：MD（Merkle-Damgård）或ChopMD-based HMAC。对于MD-based HMAC，其MAC和PRF安全性的上界分别为O(ℓq^2^(2n))，这里，ℓ表示最大查询长度。而对于ChopMD-based HMAC，其上界为O(q^2^(2n) + ℓq^2^(2n)+t)，t可能涉及到额外的复杂度。
通过比较，文章揭示了使用SHA-3替换SHA-2的优势，即在保持相同或类似查询复杂度的情况下，SHA-3-based HMAC提供了更为严格的安全保障。这为实际应用中的密码学设计提供了理论依据，尤其是在对安全性有高要求的环境中，如金融交易、数据加密等领域，选择SHA-3作为HMAC的基础哈希函数可以增强系统的安全性，降低被攻击的风险。
这篇研究论文深入探讨了SHA-3在提高HMAC通用安全性的潜力，为密码学研究人员和开发者提供了关于如何优化HMAC构造以抵御未来威胁的重要指导。
Size HMAC-SHA3-n HMAC-SHA-n HMAC-SHA-n/512
n q (MAC) q (PRF) q (MAC,PRF) q (MAC,PRF)
224 2
216.192...
2
112
min{2
112
, 2
128
/ℓ
1/2
} 2
112
256 2
248
2
128
2
128
/ℓ
1/2
2
128
384 2
375.415...
2
192
min{2
192
, 2
256
/ℓ
1/2
} –
512 2
503
2
256
2
256
/ℓ
1/2
–
Table 1. Comparisons security of HMAC Sponge with security of HMAC MD and
HMAC ChopMD
respectively. We put n’s and t’s of SHA-2 family to the upper-bounds for HMAC MD
(O(
ℓq
2
2
n
)) and HMAC ChopMD (O(
q
2
2
n
+
ℓq
2
2
n+t
)). The results are shown in the columns
for HMAC-SHA-n and HMAC-SHA-n/512. Since the upper-bounds on the MAC- and
PRF-security are the same, we group q’s of the MAC- and PRF-security together.
Note that the exact values of q’s for HMAC-SHA-224/512 and HMAC-SHA-256/512
are min{2
112
, 2
256
/ℓ
1/2
} and min{2
128
, 2
256
/ℓ
1/2
}, respectively. In the table, we
assume that ℓ ≤ 2
256
.
From the table, when fixing the output length n ∈ {224, 256, 384, 512}, re-
placing the SHA-2 hash function with the SHA-3 hash function enhances the
MAC-security of HMAC. For n ∈ {256, 512 }, replacing SHA-n with SHA3-n en-
hances the PRF-security of HMAC. Replacing SHA-256 with SHA3-256 enhances
the PRF-security of HMAC if ℓ > 2
64
, and does not otherwise. Replacing SHA-
384 with SHA3-384 enhances the PRF-security of HMAC if ℓ > 2
128
, and does
not otherwise. For n ∈ {224, 256}, replacing SHA-n/512 with SHA3-n does not
enhance the PRF-security of HMAC.
Finally, we remark that the above discussion relies on the known upper-
bounds for HMAC MD and HMAC ChopMD. The upper-bounds on the PRF-security
of HMAC MD and HMAC ChopMD are tight, since a collision on internal states of-
fers a distinguishing attack. The upper-bound on the MAC-security of HMAC MD
is also tight, since a collision on internal states of the inner function offers a
forgery attack. On the other hand, the upper-bound on the MAC-security of
HMAC ChopMD may not be tight, since ChopMD has the wide size internal state
which ensures that the collision probability in the internal states is smaller than
the known upper-bound. We conjecture that our proof of HMAC Sponge (Proof
of Theorem 1) is applicable to HMAC ChopMD, and thus the upper-bound on the
MAC-security becomes O(
nq
2
n
+
ℓq
2
2
n+t
).
Previous Works for Other SHA-3 based MACs. Bertoni et al. [7] sug-
gested the use of the keyed Sponge construction with the structure Sponge(K∥m),
which we denote by PrefixMAC. PrefixMAC calls Sponge one time, while HMAC
calls it twice. Hence PrefixMAC is more efficient than HMAC Sponge. At CRYPTO
2015, Gaˇzi et al. [12] proved the tight upper-bound on the PRF-security of
PrefixMAC, where the upper-bound is O(
q
2
2
b−d
+
Qq
2
b−n
), assuming ℓq ≤ 2
b/2
and
Q ≤ 2
b/2
. Since the PRF-security is carried over into the MAC-security, the
bound on the MAC-security is O(
q
2
n
+
q
2
2
b−n
+
Qq
2
b−n
). When 3n ≤ b, PrefixMAC
4
剩余15页未读，继续阅读
2018-06-09 上传
2017-09-23 上传
2022-07-15 上传
2022-07-15 上传
2022-07-14 上传
2022-07-14 上传
2021-02-06 上传
2015-02-03 上传
weixin_38692836
- 粉丝: 4
- 资源: 974
我的内容管理
展开
最新资源
- Raspberry Pi OpenCL驱动程序安装与QEMU仿真指南
- Apache RocketMQ Go客户端：全面支持与消息处理功能
- WStage平台：无线传感器网络阶段数据交互技术
- 基于Java SpringBoot和微信小程序的ssm智能仓储系统开发
- CorrectMe项目：自动更正与建议API的开发与应用
- IdeaBiz请求处理程序JAVA：自动化API调用与令牌管理
- 墨西哥面包店研讨会：介绍关键业绩指标(KPI)与评估标准
- 2014年Android音乐播放器源码学习分享
- CleverRecyclerView扩展库：滑动效果与特性增强
- 利用Python和SURF特征识别斑点猫图像
- Wurpr开源PHP MySQL包装器：安全易用且高效
- Scratch少儿编程：Kanon妹系闹钟音效素材包
- 食品分享社交应用的开发教程与功能介绍
- Cookies by lfj.io: 浏览数据智能管理与同步工具
- 掌握SSH框架与SpringMVC Hibernate集成教程
- C语言实现FFT算法及互相关性能优化指南
