Problem - Kevin Tafuro

Solution
In most cases, instead of using a standalone MAC, we recommend that you use a
dual-use mode that provides both authentication and encryption all at once (such as
CWC mode, discussed in Recipe 5.10). Dual-use modes can also be used for authentication
when encryption is not required.
If a dual-use mode does not suit your needs, the best solution depends on your particular
requirements. In general, HMAC is a popular and well-supported alternative
based on hash functions (it’s good for compatibility), and OMAC is a good solution
based on a block cipher (which we see as a strong advantage). If you care about maximizing
efficiency, a hash127-based MAC is a reasonable solution (though it has
some limitations, so CMAC may be better in such cases; see Recipes 6.13 and 6.14).
We recommend against using RMAC and UMAC, for reasons discussed in the following
section.
Discussion
Do not use the same key for encryption that you use in a MAC. See
Recipe 4.11 for how to overcome this restriction.
As with hash functions, there are a large number of available algorithms for performing
message authentication, each with its own advantages and drawbacks. Besides
algorithms designed explicitly for message authentication, some encryption modes
such as CWC provide message authentication as a side effect. (See Recipe 5.4 for an
overview of several such modes, and Recipe 6.10 for a discussion of CWC.) Such
dual-use modes are designed for general-purpose needs, and they are high-level
enough that it is far more difficult to use these modes in an insecure manner than
regular cryptography.
Table 6-2 lists interesting message authentication functions, all with provable security
properties assuming the security of the underlying primitive upon which they
were based. This table also compares important properties of those functions. When
comparing speeds, we used an x86-based machine and unoptimized implementations
for testing. Results will vary depending on platform and other operating conditions.
Speeds are measured in cycles per byte; lower numbers are better.
Table 6-2. MACs and their properties
Small message
speed (64
MAC Built upon
bytes) a
Large
Patent
message Appropriate restricParallel- speed (8K) for hardware tionsizable CMAC A universal hash and AES ~18 cpb ~18 cpb Yes No Yes
HMAC-
SHA1
Message digest function 90 cpb 20 cpb Yes No No
Choosing a Message Authentication Code | 259
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.