Abstract:
We propose an obfuscation method for using hash-based message authentication codes (MAC) in untrusted systems. Our method is implemented for MAC in a form $H(k,x)=h(k,p_1,h(k,p_2,x))$. The main idea is to use inner states of a hash function $h$. We calculate both $h$ intermediate values in a such way that all key related blocks are already reduced by the hash compression function. That values are $h(epad(k,p_1))$ and $h(epad(k,p_2))$, where $epad$ is a key padding algorithm. Then we use them in functions $h_1$ and $h_2$, which calculate $h$ with the initial block equalled $h(epad(k,p_1))$ and $h(epad(k,p_2))$ respectively. So, accordingly to the following equation, these new functions implement original MAC algorithm: $H(k,x)=h(k,p_1,h(k, p_2, x))=h_1(h_2(x))$.
Keywords:white-box cryptography, message authentication codes, HMAC, obfuscation, web application security.