Subject: RE: [TLS] Truncated HMAC recommendation

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 27 Nov 2006 14:27:42 -0500

>> MAC truncation is not done to save bytes over the wire.
>
>The spec says that "it may be desirable in constrained
>environments to save bandwidth by truncating the output
>of the hash function to 80 bits when forming MAC tags."
>
>If that weren't the case, why would you want to
>truncate the MAC?

*I* would want to truncate the MAC to make cryptanalytic job of my
adversary harder by forbidding him verification of his guesses of the
correct authentication key (as I do not provide the entire computed
MAC).

On the other hand, truncatng MAC makes the birthday paradox attacks
easier (the shorter the MAC - the fewer messages you need). So the
transmitted MAC size is a compromise between mitigating both of these
two threats.

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: "Whyte, William" <[email-masked]>
Date: Mon, 27 Nov 2006 14:39:03 -0500

> correct authentication key (as I do not provide the entire computed

But if you truncate it to half-length, two MACs are enough to allow
verification of a guess with high probability. I don't think this
is a significant gain.

William

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 27 Nov 2006 15:54:48 -0500

> But if you truncate it to half-length, two
> MACs are enough to allow verification of a
> guess with high probability. I don't think
> this is a significant gain.

Cryptologic science disagrees with you. 

If your MAC size is N bits and your key size is K bits, then you need
K/N known pairs of messsage <-> MAC in order to verify your guess of the
key (I wonder why you think that just two MACs are enough if you leave
only half of the MAC bits). Among other sources, see
<http://www.cosic.esat.kuleuven.be/publications/thesis-16.pdf> (page
15).

---

From: "Whyte, William" <[email-masked]>
Date: Mon, 27 Nov 2006 19:43:55 -0500

Okay, so I was foolishly assuming that the key size was equal to the
non-truncated MAC length. Even given that the key size might be
larger, it'll be rare in TLS to require more than 16 (MAC, message)
pairs, so I think the broader point (that truncation doesn't
significantly raise the bar for an attacker who can collect messages)
still holds.

William

> -----Original Message-----
> From: Blumenthal, Uri [mailto:[email-masked]] 
> Sent: Monday, November 27, 2006 3:55 PM
> To: [email-masked]
> Subject: RE: [TLS] Truncated HMAC recommendation
>