English
Menu

Applied Cryptography

Using the hash SHA-256(K ‖ m) of a secret key K concatenated with a message m as a tag for detecting tampering is considered dangerous. Which of the following is the reason?

  1. AIf the tag and the input length are known, the tag of a message with data appended after m can be computed without knowing K
  2. BAn efficient method is known for working back from the SHA-256 output to just the key K placed at the start of the input
  3. CPlacing the key K in front of the message makes the input longer, and with SHA-256 this makes collisions easier to find
Show answer and explanation

Answer: A. If the tag and the input length are known, the tag of a message with data appended after m can be computed without knowing K

In a Merkle–Damgård hash function such as SHA-256, the output hash value is exactly the internal state after the last block has been processed. An attacker can therefore take the tag as the internal state and continue the computation, obtaining the hash of K ‖ m followed by padding of a fixed form and arbitrary data, without knowing K (a length extension attack). HMAC, which uses two values derived from the key and hashes the inner hash value once more together with the key, prevents this attack. SHA-3 is not vulnerable to this attack by its construction, so KMAC, which simply puts the key in front, has also been standardized.

  • A. Correct. This is called a length extension attack, and it is one of the reasons for using HMAC.
  • B. No efficient method of finding the input from the SHA-256 output is known. The problem is not working backwards but being able to continue the computation.
  • C. A longer input does not make collisions easier to find.
Practice this topic Back to topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

More Applied Cryptography questions

  1. Let 1 GiB = 2³⁰ bytes and 1 EiB = 2⁶⁰ bytes. A block cipher with a 64-bit block (such as 3DES) is used in CBC mode to encrypt a large amount of data under one key. Treating the ciphertext blocks as random 64-bit values, which of the following is the approximate amount of data at which, by the birthday paradox, the probability that a pair of identical ciphertext blocks appears can no longer be ignored?
  2. In protocols such as TLS 1.3, the shared secret obtained from an ECDHE key exchange is not used directly as an encryption key; instead keys are made by passing it through a key derivation function (KDF) such as HKDF. Which of the following is an appropriate reason?
  3. The mechanism of RSA is checked with small numbers. From the primes p = 5 and q = 11, n = pq is formed, and the public exponent is e = 3. With φ(n) = (p − 1)(q − 1), which of the following is the private exponent d (0 < d < φ(n)) that satisfies e × d ≡ 1 (mod φ(n))?
  4. In RSA, let the public key be n = 55 and e = 3. Which of the following is the ciphertext c when the plaintext m = 7 is encrypted as c = m^e mod n?
  5. Which of the following correctly describes a problem with using textbook RSA (computing c = m^e mod n directly from the plaintext m) without padding in real communication?

Comparisons in this topic