0

I know that for HMAC/SHA there are default IV values. But if I want to supply my own IV (different from a default), there doesn't seem to be a way to implement it in — for example — Java. (At least, so far I hadn't found a solution in javax/bouncy castle. Looks like MessageDigest class isn't providing us with such methods).

Why are default values for IV (HMAC/SHA) used? What is the reason not expose them to a user?

e-sushi
  • 17,891
  • 12
  • 83
  • 229
user3698979
  • 63
  • 1
  • 5
  • HMAC doesn't have an IV. It only takes two parameters (for a given hash algorithm): the key and the message. What are you calling an IV? What makes you think there is one? – Gilles 'SO- stop being evil' Jun 13 '17 at 09:04
  • By the way, coding questions, such as how to use a API, are off-topic here. A question about the algorithm, such as whether HMAC has an IV, is on-topic here, but it's not clear at this point what your question would be. – Gilles 'SO- stop being evil' Jun 13 '17 at 09:05
  • 1
    I'm referring to an initial value used to start the hash/hmac iterated process. Hmac/hash have some fixed IV, which is just an arbitrary constant being used as an initial value, before any actual data is fed to the function. It is usually not exposed to the user. What I want to do is to be able to change this initial value. – user3698979 Jun 13 '17 at 09:11
  • 1
    This is definitely a coding question. Java's cryptoapi for SHA hashes, and most other SHA libraries, have no provision for changing the IV (more precisely, the initial hash value), because FIPS 180-4 defines what the IVs should be. Your best option might be to adapt an existing SHA library. Because it is usually interpreted, Java is NOT the language of choice for efficient implementation of crypto. – fgrieu Jun 13 '17 at 10:32
  • Those constants are not exposed in APIs because you aren't supposed to change them. If you change the value, you're no longer using e.g. HMAC-SHA-256 but some custom algorithm that happens to be vaguely like HMAC-SHA-256 but may or may not be as secure. If you want to code a custom algorithm that is similar, but not identical to SHA-256 then your best bet would be to take an open source implementation of SHA-256 and modify it. – Gilles 'SO- stop being evil' Jun 13 '17 at 10:51
  • @fgrieu The JCA has an efficient mechanism to implement providers for cryptographic implementations (native or otherwise). And although it is interpreted, it is compiled to relatively efficient byte code. Finally, it allows for code to be supplanted with native code through Java "intrinsics". So in the end it may be slower than "native" compiled code (C/C++ mainly) but it is basically faster than anything else out there. Some interpreted languages of course just use C/C++ compiled modules underneath. – Maarten Bodewes Jun 13 '17 at 12:46
  • Note that your last "also" question could stand on its own (when reworded / better explained) and would be on topic here. So you can salvage this a bit. The rest is of course clearly off topic. – Maarten Bodewes Jun 13 '17 at 12:47

1 Answers1

1

Why are default values for IV (HMAC/SHA) used? What is the reason not expose them to a user?

Actually, if you go through the theoretical basis of HMAC as explored in this paper, they start with NMAC, which is essentially what you are asking for. That is, it's a nested hash construction (just like HMAC), however instead of prepending the hash with keying material, they set the IV for both levels to keying data.

They then go on to HMAC, and show that HMAC is as secure as NMAC; the prepended keying material (which occupies precisely one hash block) sets the hash internal state to a value which is unpredictable to someone who doesn't know the key. HMAC also has the advantage that it can be implemented using a standard hash implementation.

Hence, the answer is "you don't need to set the HMAC IV values; the HMAC keys do that for you"

e-sushi
  • 17,891
  • 12
  • 83
  • 229
poncho
  • 147,019
  • 11
  • 229
  • 360