RE: [Cfrg] Interim MAC function

[Hugo Krawczyk <hugo at ee.technion.ac.il>]

It seems that the proposal was
MASH(m)=HMAC-SHA1(K=SHA1(m), M=m)
(i.e. HMAC-SHA1 with message m and key SHA1(m))

If we ignore the opad/ipad padding of HMAC and the length-encoding
padding of SHA1 this becomes something like
H(H(m)|H(H(m)|m))
(where | stands for concatenation and H is SHA1 with length padding omitted).
Up to some IV replacemnt and assuming m to be a multiple
of 512 bits one has that H(H(m)|m) is "close" to H(m|m).
In this case we get that MASH(m) can be "approximated" by
H(H(m)|H(m|m)).

For the latter to be considered collision resistant one needs to assume
that finding collisions between two messages m,m' and alsso between m|m
and m'|m' is difficult.  I would not count on it.

But then again this is only an approximation.

Hugo




_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg