Message authentication code algorithms
This presentation is the property of its rightful owner.
Sponsored Links
1 / 15

Message Authentication Code Algorithms PowerPoint PPT Presentation


  • 65 Views
  • Uploaded on
  • Presentation posted in: General

Message Authentication Code Algorithms. CSIS 5857: Encoding and Encryption. Digests and Networks. Same hash applied to message by sender and recipient Sender creates digest and sends along with message Recipient creates digest from received message, and compares to received digest

Download Presentation

Message Authentication Code Algorithms

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Message authentication code algorithms

Message Authentication Code Algorithms

CSIS 5857: Encoding and Encryption


Digests and networks

Digests and Networks

  • Same hash applied to message by sender and recipient

    • Sender creates digest and sends along with message

    • Recipient creates digest from received message, and compares to received digest

    • If no match, message has been tampered with en route

M


Digests and networks1

Digests and Networks

  • Problem: Adversary can easily intercept digest and change it to match new message

    • Must assume adversary knows hash function we use!

M

h(M)


Message authentication codes

Message Authentication Codes

Using secret key to create digest

  • Creates MAC as h(M, k)

  • Without k, Darth can’t substitute Mand then duplicate the h(M, k) that recipient will use to check message integrity

  • k must be large enough to prevent exhaustive search


Message authentication codes1

Message Authentication Codes

  • Provides some authentication of sender

    • Only person with correct keyk can produce h(M, k) that matches message M

    • Also provides some nonrepudiation protection

      • Sender cannot later claim they did not send message unless key stolen

    • Can also involve digital signatures

compare

h(M, k)

M

h(M, k)

“If they match, thensender must have samekey k as I do”

M

h(M, k)

h

k


Authentication and confidentiality

Authentication and Confidentiality

  • Can also encrypt message with different key

    • Hash plaintext before encryption

    • Hash ciphertextafter encryption

      • Allows authentication to take place without decryption(usually much faster)

h

h

h

h

h

h

h


Prefix postfix mac

Prefix/Postfix MAC

  • Key = “extra bits” at beginning or end of messageh(M, k) = h(M|k) or h(k| M)

  • Hash algorithm used must have strong “avalanche effect”

    • Changing few bits at beginning/end changes most bits of MAC even if rest of message is the same

    • Better if key “spread out” over message rather than at known fixed location

Message


Nested mac

Nested MAC

  • Hashing applied multiple times

    • Concatenate key with message:k | M

    • Run through hash: h(k | M)

    • Concatenate key again: k |h(k | M)

    • Run through hash again:MAC = h(k |h(k | M))

  • Changes in key have greater avalanche effect on final MAC


Hashed mac hmac

Hashed MAC (HMAC)

  • 2-stage nested MAC

    • Intermediate result of first hash padded to increase complexity next hash

  • Different “round keys” generated for each hash

    • Stage 1: k1 = k ipad

    • Stage 2: k2 = k opad


Hashed mac hmac1

Hashed MAC (HMAC)

  • Stage 1: k1= k ipad

    • Key k padded out to b bits with extra 0’s

    • ipad = 00110110 00110110 … repeated to bbits

  • Stage : k2= k opad

    • opad = 01011100 01011100 … repeated to bbits

  • Key idea:ipad and opad differ in half of possible bitsk1and k2will differ very greatly


Chained mac cmac

Chained MAC (CMAC)

  • “Hashless” MAC

    • Uses an encryption algorithm (DES, AES, etc.) to generate MAC


Chained mac cmac1

Chained MAC (CMAC)

  • Based on same idea as cipher block chaining

    • Message broken into N blocks

    • Each block fed into an encryption algorithm with key

    • Result XOR’d with next block before encryption to make final MAC depend on all blocks

  • Compresses result to size of single block (unlike encryption)


Chained mac cmac2

Chained MAC (CMAC)

  • Final stage uses “additional key”

    • Derived from cipher key but hides relationship to key:

      • Encrypting all 0’s

      • Multiplying by x or x2over GF(2n)


Chained mac cmac3

Chained MAC (CMAC)

  • Additional key XOR’d with final block

  • Crucial to use different key for last XOR

    • Avoids differential cryptanalysis of 2 messages with same beginning

  • MAC = leftmost n bits of result


Chained mac cmac4

Chained MAC (CMAC)

  • Advantages:

    • Can use existing encryption functions

    • Encryption functions have properties that resist preimage and collision attacks

      • Ciphertext designed to appear like “random noise” – good approximation of random oracle model

      • Most exhibit strong avalanche effect – minor change in message gives great change in resulting MAC

  • Disadvantage:

    • Encryption algorithms (particularly when chained) can be much slower than hash algorithms


  • Login