Problem - Kevin Tafuro

Table 6-2. MACs and their properties (continued)
Small message
speed (64
MAC Built upon
bytes)
MAC127 hash127 + AES ~6 cpb ~6 cpb Yes No Yes
OMAC1 AES 29.5 cpb 37 cpb Yes No No
OMAC2 AES 29.5 cpb 37 cpb Yes No No
PMAC-
AES
Block cipher 72 cpb 70 cpb Yes Yes Yes
RMAC Block cipher 89 cpb 80 cpb Yes No No
UMAC32 UHASH and AES 19 cpb cpb No No Yes
XMACC-
SHA1
Any cipher or MD function 162 cpb 29 cpb Yes Yes Yes
a
Large
Patent
message Appropriate restricParallel- speed (8K) for hardware tionsizable a All timing values are best cases based on our empirical testing, and assume that the data being processed is already in cache. Do not
expect that you’ll quite be able to match these speeds in practice.
Note that our considerations for comparing MACs are different from our considerations
for comparing cryptographic hash functions. First, all of the MACs we discuss
provide a reasonable amount of assurance, assuming that the underlying
construct is secure (though MACs without nonces do not resist the birthday attack
without additional work; see Recipe 6.12). Second, all of the cryptographic hash
functions we discussed are suitable for hardware, patent-free, and not parallelizable.
Let’s look briefly at the pros and cons of using these functions.
CMAC
CMAC is the MAC portion of the CWC encryption mode, which can be used in
a standalone fashion. It’s built upon a universal hash function that can be made
to run very fast, especially in hardware. CMAC is discussed in Recipe 6.14.
HMAC
HMAC, discussed in Recipe 6.10, is a widely used MAC, largely because it was
one of the first MAC constructs with provable security—even though the other
MACs on this list also have provable security (and the proofs for those other
MACs tend to be based on somewhat more favorable assumptions). HMAC is
fairly fast, largely because it performs only two cryptographic operations, both
hashes. One of the hashes is constant time; and the other takes time proportional
to the length of the input, but it doesn’t have the large overhead block
ciphers typically do as a result of hash functions having a very large block size
internally (usually 64 bytes).
HMAC is designed to take a one-way hash function with an arbitrary input and
a key to produce a fixed-sized digest. Therefore, it cannot use block ciphers,
unless you use a construction to turn a block cipher into a strong hash function,
which will significantly slow down HMAC. If you want to use a block cipher to
260 | Chapter 6: Hashes and Message Authentication
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.