University of Waterloo

ECE 458

ECE-458 { Computer Security (Spring 2018)
Suggested Solutions to Selected Practice Problems { Set #4
1 { MACs vs. Digital Signatures
For the purpose of this question, we will consider the simple form of message authentication codes
(MACs): given a message m, a key K, and a cryptographic hash function H, the MAC tag is
computed as:
MAC(m; K) = H(mjjK)
where jj denotes concatenation.
We could also consider the standard, HMAC (keyed-hash or hash-based MAC), which does a \nested
hashing" to avoid a vulnerability (namely, length extension attack) of the simpler form above:
HMAC(m; K) = H ((K′ ⊕ OPAD) jj H((K′ ⊕ IPAD) jj m))
where K′ is a derived key that matches H’s block size| either padded (if shorter) or hashed (if
longer), and OPAD and IPAD are fixed padding patterns defined as part of the HMAC standard.
(a) Describe a protocol to provide integrity guarantee in a transmission (e.g., an e-mail message)
using MACs (either the simple form above, or the HMAC).
Sender computes the MAC and attaches it to the message being transmitted; recipient (who also
knows K) computes the MAC of the received message, and compares against the received MAC.
Follow-up exercise: why does it work?
(b) Explain why MACs are to Digital sign