Problem - Kevin Tafuro

Discussion
Be sure to look at our generic recommendations for using a MAC (see
Recipe 6.9).
The hash127 algorithm is a universal hash function that can be turned into a secure
MAC using AES. It is available from Dan Bernstein’s web page: http://cr.yp.to/
hash127.html. Follow the directions on how to install the hash127 library. Once the
library is compiled, just include the directory containing hash127.h in your include
path and link against hash127.a.
Unfortunately, at the time of this writing, the hash127 implementation
has not been ported to Windows. Aside from differences in inline
assembler syntax between GCC and Microsoft Visual C++, some constants
used in the implementation overflow Microsoft Visual C++'s
internal token buffer. When a port becomes available, we will update
the book’s web site with the relevant information.
The way to use hash127 as a MAC is to hash the message you want to authenticate
(the hash function takes a key and a nonce as inputs, as well as the message), then
encrypt the result of the hash function using AES.
In this recipe, we present an all-in-one MAC API based on hash127, which we call
MAC127. This construction first hashes a message using hash127, then uses two
constant-time postprocessing operations based on AES. The postprocessing operations
give this MAC excellent provable security under strong assumptions.
When initializing the MAC, a 16-byte key is turned into three 16-byte keys by AESencrypting
three constant values. The first two derived keys are AES keys, used for
postprocessing. The third derived key is the hash key (though the hash127 algorithm
will actually ignore one bit of this key).
Note that Bernstein’s hash127 interface has some practical limitations:
• The entire message must be present at the time hash127( ) is called. That is,
there’s no incremental interface. If you need a fast incremental MAC, use CMAC
(discussed in Recipe 6.13) instead.
• The API takes an array of 32-bit values as input, meaning that it cannot accept
an arbitrary character string.
However, we can encode the leftover bytes of input in the last parameter passed to
hash127( ). Bernstein expects the last parameter to be used for additional per-message
keying material. We’re not required to use that parameter for keying material
(i.e., our construction is still a secure MAC). Instead, we encode any leftover bytes,
then unambiguously encode the length of the message.
288 | Chapter 6: Hashes and Message Authentication
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.