“YOLO” is not a valid hash construction

Summary: Trail of Bits describes three ad-hoc hash constructions it commonly finds in client products: a multi-value hash that concatenates messages with a separator string, a MAC built as H(K ‖ M), and a password KDF built as H(S ‖ P). The separator approach produces identical hashes for semantically distinct inputs when a message contains the separator, the key-prefix MAC is open to length-extension attacks on Merkle-Damgård hashes like SHA256 and to key/message ambiguity, and the password construction can be attacked at hundreds of billions of candidates per second on rented GPU instances.
What's compelling: The firm notes these problems have been solved for a quarter century - HMAC since the late 1990s, KMAC since 2016, Argon2 and scrypt available in multiple languages - yet the constructions still appear in security reviews, and the separator flaw has already been used to break widely used libraries.

Read the original at Trail of Bits Blog ↗