Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

HMAC used to secure chosen cipher-text attacks. if we are encrypting a large file (video) and sending it over TLS for decryption, how server can check MAC for ciphertext when we didn't sent whole of ciphertext yet ?

share|improve this question
up vote 5 down vote accepted

Well, when TLS encrypts a stream of traffic, it breaks up the data into records. Each record contains up to 16k of data, and includes its own HMAC. Hence, there is no HMAC over the entire downloaded file; instead, there are a series of HMACs; every single byte of data is covered by one of those HMACs.

share|improve this answer
And also each HMAC is computed over the concatenation of the record data and a record sequence number, so that attackers may not drop, replay or reorder individual records. – Thomas Pornin Mar 25 '13 at 22:55
if we add HMAC to each block of ciphertext then its size will be double ? adding just one byte MAC to 8 byte ciphertext blocks can provide security ??! – rsa Mar 26 '13 at 7:06
The records Poncho and Thomas Pornin mention are up to 2^14 bytes in length. There is one MAC for each such record. The length of the MAC is typically equal to the length of the underlying hash, if a cipher suite with a HMAC is selected during the handshake. However, this might depend on which cipher suites and which handshake extensions are implemented and in effect as a result of the handshake. – Henrick Hellström Mar 26 '13 at 7:59
@Henrick Hellström if we use smart cards then how you send 2^14 byte to card ? – rsa Mar 26 '13 at 20:19
@rsa: Well, since we typically don't use TLS to communicate with smart cards, well, that's a different question. However, the gist of it is that it's possible to compute an HMAC incrementally; that is, give it the data being HMAC's in pieces; with a fixed amount of storage, we're able to compute the HMAC of the entire message, even though we never saw the entire message at any one time. – poncho Mar 26 '13 at 21:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.