[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: 32 bit counter -- 96 bit HMAC-SHA/MD5
From: Derek Atkins <warlord@MIT.EDU>
Date: 14 Feb 1997 15:35:11 -0500
I'd be afraid that truncating to 96 bits would make brute-force
attacks too easy. We've already seen 48 bit RC5 keys falling in very
short amounts of time (hours) using brute-force methods. Today.
These MACs need to be secure for YEARS! I don't think that a 96-bit
MAC is long-enough to survive brute-force attacks for very long.
Derek,
I'm not a cryptographer, so take my comments with a grain of
salt, but my understanding is that MAC's, unlike cryptographic
checksums, aren't subject to birthday attacks, since key used to
generate the MAC is secret. Hence, HMAC truncated to 64 bits has an
attack difficulty of O(2**64), and HMAC truncated to 96 bits has an
attack difficulty of O(2**98), NOT O(2**48).
- Ted
References: