Subject: Re: [bitcoin-dev] BIP 151 use of HMAC_SHA512

From: Ethan Heilman <[email-masked]>
Date: Wed, 29 Jun 2016 10:38:43 -0400

Just to clarify in BIP-0151 when it says:

>It is important to include the cipher-type into the symmetric cipher key to avoid weak-cipher-attacks.

the cipher-type here refers to the ECDH negotiation parameters?

On Wed, Jun 29, 2016 at 2:58 AM, Pieter Wuille <[email-masked]> wrote:
> On Jun 29, 2016 07:05, "Ethan Heilman via bitcoin-dev"
> <[email-masked]> wrote:
>>
>> >It's also not clear to me why the HMAC, vs just
>> > SHA256(key|cipher-type|mesg).  But that's probably just my crypto
>> > ignorance...
>>
>> SHA256(key|cipher-type|mesg) is an extremely insecure MAC because of
>> the length extension property of SHA256.
>
> This property does technically not apply here, as the output of the hash is
> kept secret, and the possible messages are constants (which are presumably
> chosen in such a way that one is never an extension of another).
>
> However, this is a good example of why you can't generically use a hash
> function in places where you want a MAC (aka "a hash with a shared secret").
> Furthermore, if you already have a hash function anyway, HMAC is very easy
> construct on top of it.
>
> --
> Pieter