Recommendation for applications using approved hash algorithms

Abstract

Hash functions that compute a fixed-length message digest from arbitrary length messages are widely used for many purposes in information security. This document provides security guidelines for achieving the required or desired security strengths when using cryptographic applications that employ the approved hash functions specified in Federal Information Processing Standard (FIPS) 180-4. These include functions such as digital signatures, Keyed-hash Message Authentication Codes (HMACs) and Hash-based Key Derivation Functions (Hash-based KDFs).

Another Look at Tightness

“…If parameters are selected without accounting for the tightness gap in the reduction, then the MAC scheme is shown to provide a level of security that is less than what one would desire in the multi-user setting. In particular, the attacks we describe are effective on HMAC as standardized in [33,26] and CMAC as standardized in [28,72]. In §3, we show that this deficiency in the security assurances provided by the non-tight proof appears in a network authentication protocol [20], and in §4 we obtain analogous results for aggregate MACs and aggregate designated verifier signatures.…”

“…We next argue that Attack 1 is effective on HMAC as standardized in [33,26] and CMAC as standardized in [28,72].…”

“…It is stated in [26] that the "security strength" of HMAC is the minimum of r and 2d, and the only requirement on tag lengths is that t ≥ 8. Hence, if one were to use HMAC with SHA-1 [32] (which has d=160) as the underlying hash function and select r=t=80, then the resulting MAC scheme would be compliant with SP 800-107 and be expected to achieve an 80-bit security level.…”

“…HMAC is also standardized in FIPS 198-1 [33], with recommendations for parameter sizes given in SP 800-107 [26]. It is stated in [26] that the "security strength" of HMAC is the minimum of r and 2d, and the only requirement on tag lengths is that t ≥ 8.…”

Protecting PROFINET cyclic real-time traffic: A performance evaluation and verification platform

“…SHA-3 is based on a completely different mathematical structure as its predecessors SHA-2 and SHA-1. SHA-1 is known to be vulnerable against collision attacks and is therefore not recommended to be used in new designs [11]. Although these weaknesses do not affect the security of SHA-2 to the present date, emerging issues can be expected in the future since it shares the mathematical structure of SHA-1.…”