# How to use HMAC-SHA1, HMAC-SHA2 in conjunction with AES

I understand how to compute HMAC-SHA1, HMAC-SHA2 etcetera.

Please explain why/how is the resulting HMAC value is used in conjunction with AES for encryption/decryption and signing/verifying.

In particular:

1. How does HMAC interact with AES for key sizes (AES-128, AES-196 and AES-256)?
2. Is the calculated MAC encrypted using AES? And if so, why?
3. How about signing and verifying? How does the AES cipher play a role here?
4. Is it correct that the AES ciphertext is HMAC-ed for signing and the HMAC is verified?
-

Is the calculated MAC encrypted using AES? What is the purpose? How about signing and verifying? How does AEs Play a role here? Is the case here that the encrypted AES is HMACed for signing and the HMAC is verified

No, the MAC is not encrypted per se, however, it is calculated in conjunction with a key (independent of the encryption key).

Simply encrypting your data ensures privacy, however, it doesn't ensure integrity (ie, that the ciphertext hasn't been tampered with since it was encrypted). Using a HMAC provides this integrity.

A simple hash function by itself is not sufficient, as an attacker could alter the ciphertext, calculate a new hash, append it to the new ciphertext, and you would be unable to detect any tampering. A HMAC solves this problem as it uses a key - meaning that an attacker is unable to create a valid HMAC unless they have a valid key (which only you possess).

You should note that if you plan to encrypt-then-HMAC, you not only need to calculate the MAC of the ciphertext, but also the IV ...ie, HMAC((ciphertext+IV), key)

You should also note that independent keys should be used for the encryption (AES, for example) and the authentication (HMAC). One approach is to use a masterkey, and then derive two separate keys using a KDF.

Of course, using an authenticated encryption mode such as GCM or EAX is less prone to implementation errors (assuming you're using a well-vetted library), and is recommended if you don't have much experience in crypto.

-
Can you Elaborate on the use of one master key? At the Moment I have this crypto library that is a Blackbox to me and when I fed a 128 bit AES key and choose AES with HMAC Sha1 it works. The same Routine seems to also work with a 160 bit key. So I am a bit lost. –  user907810 Oct 31 '13 at 13:57
@user907810 - I can't speculate as to what's happening internally in your library. Regarding a 'master key', well assuming you begin with a 128-bit (minimum) cryptographically strong key (the master key), you could use something like HKDF to derive encryption and authentication keys. –  hunter Oct 31 '13 at 15:37

1. HMAC can be used with any key size (as the key is basically used as input for the underlying hash function). If the key size is too small then the security of the HMAC is of affected. In general, the key size should be at least the output size of the hash algorithm divided by two. It is best practice to use a separate key for calculating the HMAC though.

2. There are a lot of discussions if you should encrypt apply the MAC or the other way around. Encrypt and then MAC is best practice. One of the bigger reasons is the vulnerability of padding oracle attacks on e.g. CBC. To avoid these you must verify the MAC value before decryption. HMAC itself does not use the AES algorithm in any way (the AES-CMAC algorithm does but that algorithm requires an additional key).

3. The AES cipher does normally not play a role in signing/verifying, unless it is used in a cipher based MAC algorithm like the previously mentioned AES-CMAC algorithm.

4. Yes, it is correct that the AES ciphertext is HMAC-ed for signing and the HMAC is verified.

-
HMAC is one way in order to compute the MAC. Once you have encrypted with a secure block cipher as AES your data, THEN you MAC your data with your MAC key and you send AES(Data)+MAC(AES(DATA)). The order is important. First you must encrypt and then compute the MAC. If you don't do it this way there might be flaws. If you don't want to use this approach you can use a by construction authenticated mode of symmetric encryption