Problem - Kevin Tafuro

authentication in a straightforward manner using a hash function, and they believe
they would be better off doing this than using an off-the-shelf solution. Basically,
they think they can do something less complex and faster with just a hash function.
Other people think that creating some sort of “encryption with redundancy” scheme
is a good idea, even though many such schemes are known to be bad.
OMAC, HMAC, CMAC, and MAC127, which we compare in Recipe 6.4, are all
simple and efficient, and there are proofs that those constructions are secure with
some reasonable assumptions. Will that be the case for anything you put together
manually?
See Also
Recipe 6.4
6.20 Encrypting with a Hash Function
Problem
You want to encrypt with a hash function, possibly because you want only a single
cryptographic primitive and to use a hash function instead of a block cipher.
Solution
Use a hash-based MAC in counter mode.
Discussion
Use a separate key from the one you use to authenticate, and don’t
forget to use the MAC for message authentication as well!
You can turn any MAC into a stream cipher essentially by using the MAC in counter
(CTR) mode. You should not use a hash function by itself, because it’s difficult to
ensure that you’re doing so securely. Basically, if you have a MAC built on a hash
function that is known to be a secure MAC, it will be secure for encryption in CTR
mode.
There is no point in using any MAC that uses a block cipher in any way, such as
OMAC, CMAC, or MAC127 (see Recipe 6.4 for a discussion of MAC solutions).
Instead, just use the underlying block cipher in CTR mode, which will produce the
same results. This recipe should be used only when you don’t want to use a block
cipher.
Encrypting with a Hash Function | 301
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.