Subject: [MSEC] The use HMAC

From: brakta <[email-masked]>
Date: Wed, 13 Jun 2001 16:23:59 +0200

Hello,
 Mechanisms that provide such integrity check based on a secret key are
usually called "message authentication codes" (MAC). Typically, message
authentication codes are used between (two parties) that share a secret
key in order to validate information transmitted between these parties.
Can i use "message authentification codes" between more than two
parties, i mean in multicast application, specially 1- N mode ?
-- 
------------------------------------------
  Saber.BRAKTA
  LORIA - UHP NANCY I
  CAMPUS SCIENTIFIQUE B.P.239
  54506 VANDOEUVRE-LES-NANCY CEDEX
  E-mail : [email-masked]
------------------------------------------

---

From: Adrian Perrig <[email-masked]>
Date: Wed, 13 Jun 2001 12:14:37 -0700

> parties, i mean in multicast application, specially 1- N mode ?

Using a simple MAC for authenticating the sender in a broadcast is
unfortunately insecure if the receivers do not trust each other. Since
any one of the receivers knows the MAC key, it could impersonate the
sender and send forged messages to other receivers.

This is why we designed the TESLA protocol. TESLA provides efficient
authentication, at the cost of about one MAC computation per packet,
perfect robustness to packet loss, and requires loose time
synchronization between the sender and the receivers. The
authentication in TESLA is delayed, but we proposed an extension that
allows the receivers to immediately authenticate data (which works
well in environments with low packet loss).

The IETF draft is available at:
http://www.ietf.org/internet-drafts/draft-irtf-smug-tesla-00.txt
Papers on TESLA are available at:
http://paris.cs.berkeley.edu/%7Eperrig/projects.html#TESLA

Let me know if you have further questions on this,
  Adrian

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Mark Baugher <[email-masked]>
Date: Wed, 13 Jun 2001 13:57:19 -0700

Hi

>parties, i mean in multicast application, specially 1- N mode ?

Yes you can with Adrian's caveat that a rogue member of the group
is able to impersonate a sender if you cannot uniquely authenticate
the sender.  And you can't uniquely authenticate the sender using
"group authentication" with a MAC.  But you can using digital
signatures, the cost of which can be amortized over many packets
using tesla or similar algorithms.

Mark