Problem - Kevin Tafuro

MAC (which we recommend), we strongly recommend that you use another
alternative. Note that HMAC does not use a nonce by default, making HMAC
vulnerable to capture replay attacks (and theoretically vulnerable to a birthday
attack). Additional effort can thwart such attacks, as shown in Recipe 6.12.
MAC127
MAC127 is a MAC we define in Recipe 6.14 that is based on Dan Bernstein’s
hash127. This MAC is very similar to CMAC, but it runs faster in software. It’s
the fastest MAC in software that we would actually recommend using.
OMAC1, OMAC2
OMAC1 and OMAC2, which we discuss in Recipe 6.11, are MACs built upon
AES. They are almost identical to each other, working by running the block
cipher in CBC mode and performing a bit of additional magic at the end. These
are “fixed” versions of a well-known MAC called CBC-MAC. CBC-MAC, without
the kinds of modifications OMAC1 and OMAC2 make, was insecure unless
all messages MAC’d with it were exactly the same size. The OMAC algorithms
are a nice, general-purpose pair of MACs for when you want to keep your system
simple, with only one cryptographic primitive. What’s more, if you use an
OMAC with AES in CTR mode, you need only have an implementation of the
AES encryption operation (which is quite different code from the decryption
operation). There is little practical difference between OMAC1 and OMAC2,
although they both give different outputs. OMAC1 is slightly preferable, as it has
a very slight speed advantage. Neither OMAC1 nor OMAC2 takes a nonce. As
of this writing, NIST is expected to standardize OMAC1.
PMAC
PMAC is also parallelizable, but it is protected by patent. We won’t discuss this
MAC further because there are reasonable free alternatives.
RMAC
RMAC is another MAC built upon a block cipher. It works by running the block
cipher in CBC mode and performing a bit of additional magic at the end. This is
a mode created by NIST, but cryptographers have found theoretical problems
with it under certain conditions; * thus, we do not recommend it for any use.
UMAC32
On many platforms, UMAC is the reigning speed champion for MACs implemented
in software. The version of UMAC timed for Table 6-2 uses 64-bit tags,
which are sufficient for most applications, if a bit liberal. That size is sufficient
because tags generally need to have security for only a fraction of a second,
assuming some resistance to capture replay attacks. 64 bits of strength should
* In particular, RMAC makes more assumptions about the underlying block cipher than other MACs need to
make. The extra assumptions are a bit unreasonable, because they require the block cipher to resist relatedkey
attacks, which are not well studied.
Choosing a Message Authentication Code | 261
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.