University of Waterloo

• ECE 458

• Suggested Solutions to Selected Practice Problems – Set #4 1 – MACs vs. Digital Signatures For the purpose of this question, we will consider the simple form of message authentication codes (MACs): given a message m, a key K, and a cryptographic hash function H, the MAC tag is computed as: MAC(m, K) = H(m||K) where || denotes concatenation. We could also consider the standard, HMAC (keyed-hash or hash-based MAC), which does a “nested hashing” to avoid a vulnerability (namely, length extension attack) of the simpler form above: HMAC(m, K) = H ((K′ ⊕ OP AD) || H((K′ ⊕ IP AD)|| m)) where K′ is a derived key that matches H’s block size— either padded (if shorter) or hashed (if longer), and OP AD and IP AD are fixed padding patterns defined as part of the HMAC standard. (a) Describe a protocol to provide integrity guarantee in a transmission (e.g., an e-mail message) using MACs (either the simple form above, or the HMAC). Sender computes the MAC and attaches it to the message being transmitted; recipient (who also knows K) computes the MAC of the received message, and compares against the received MAC. Follow-up exercise: why does it work? (b) Explain why MACs are to Digital signatures like symmetric-key cryptography is to public-key cryptography. Hints: why are they similar? W