Problem - Kevin Tafuro

Solution
See the “Discussion” section. Be sure to note the possible attacks on these constructs,
and how to thwart them.
Discussion
One common thread running through the three types of primitives described in this
chapter is that they take an arbitrary amount of data as an input, and produce a
fixed-size output. The output is always identical given the exact same inputs (where
inputs may include keys, nonces, and text). In addition, in each case, given random
inputs, every output is (just about) equally likely.
Types of primitives
These are the three types of primitives:
Message authentication codes
MACs are hash functions that take a message and a secret key (and possibly a
nonce) as input, and produce an output that cannot, in practice, be forged without
possessing the secret key. This output is often called a tag. There are many
ways to build a secure MAC, and there are several good MACs available, including
OMAC, CMAC, and HMAC.
Cryptographic hash functions
These functions are the simplest of the primitives we’ll discuss (even though they
are difficult to use securely). They simply take an input string and produce a
fixed-size output string (often called a hash value or message digest). Given the
output string, there should be no way to determine the input string other than
guessing (a dictionary attack). Traditional algorithms include SHA1 and MD5,
but you can use algorithms based on block ciphers (and, indeed, you can get
more assurance from a block cipher-based construction). Cryptographic hash
functions generally are not secure on their own. They are securely used in public
key cryptography, and are used as a component in a type of MAC called HMAC.
Universal hash functions
These are keyed hash functions with specific mathematical properties that can
also be used as MACs, despite the fact that they’re not cryptographically secure.
It turns out that if you take the output of a keyed universal hash function, and
combine it with seemingly random bits in particular ways (such as encrypting
the result with a block cipher), the result has incredibly good security properties.
Or, if you are willing to use one-time keys that are securely generated, you
don’t have to use encryption at all! Dan Bernstein’s hash127 is an example of a
fast, freely available universal hash function. Most people don’t use universal
hash functions directly. They’re usually used under the hood in a MAC. For
example, CMAC uses a hash127-like function as its foundation.
250 | Chapter 6: Hashes and Message Authentication
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.