Problem - Kevin Tafuro

Generally, you should prefer an encryption mode like CWC that provides both
encryption and message integrity to one of these constructions. Using a MAC, you
can get message integrity without encryption, which is sometimes useful.
MACs aren’t useful for software distribution, because the key itself must remain
secret and can’t be public knowledge. Another limitation is that if there are two parties
in the system, Alice and Bob, Alice cannot prove that Bob sent a message by
showing the MAC value sent by Bob (i.e., non-repudiation). The problem is that
Alice and Bob share a key; Alice could have forged the message and produced the correct
MAC value. Digital signature schemes (discussed in Chapter 7) can circumvent
these problems, but they have limitations of their own—the primary one is efficiency.
Attacks against one-way constructs
There are numerous classes of problems that you need to worry about when you’re
using a cryptographic hash function or a MAC. Generally, if an attacker can find collisions
for a hash function (two inputs that give the same output), that can be turned
into a real attack.
The most basic collision attack is this: given a known hash function {input, output}
pair, somehow produce another input that gives the same output. To see how this
can be a real attack, consider a public key–based digital signature scheme where the
message to “sign” gets cryptographically hashed, and the hash gets encrypted with
the private key of the signer. In such a scenario, anyone who has the associated public
key can validate the signature, and no one can forge it. (We’ll discuss such
schemes further in Chapter 7.)
Suppose that an attacker sees the message being signed. From that, he can determine
the hash value computed. If he can find another message that gives the same
hash value, he can claim that a different message is being signed from the one that
actually was. For example, an attacker could get someone to sign a benign document,
then substitute a contract that is beneficial to the attacker.
Of course, we assume that if an attacker has a way to force collisions in a reasonably
efficient manner, he can force the second plaintext to be a message of his choice,
more or less. (This isn’t always the case, but it is generally a good assumption, particularly
because it applies for the most basic brute-force attacks.)
To illustrate, let’s say that an attacker uses a hash function that is cryptographically
strong but outputs only a 16-bit hash. Given a message and a digest, an attacker
should be able to generate a collision after generating, on average, 32,768 messages.
An attacker could identify 16 places where a one-bit change could be made without
significantly changing the content (e.g., 16 places where you could put an extra space
after a period, or refrain from doing so).
If the attacker can control both messages, collisions are far easier to find. For example,
if an attacker can give the target a message of his choosing and get the target to
sign it, there is an attack that will find a collision after 256 attempts, on average.
Understanding the Basics of Hashes and MACs | 251
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.