HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

learn more… | top users | synonyms

0
votes
0answers
13 views

Are symmetric and asymmetric keys both used in SSL/TLS

As far as what I have understood, both symmetric and asymmetric keys are used in SSL/TLS, is it right? The SSL/TLS uses Asymmetric Keys (Public key encryption) to generate a session key. The session ...
3
votes
1answer
67 views

PBKDF2 Salt and Password Ordering

I am currently reading about PBKDF2, and understand that the salt is used only once, while the password is used multiple times in the computation of the final key (see this question). How would the ...
7
votes
2answers
344 views

Is it secure to derive an AES key from a MAC?

I'm working on a project where we need to encrypt a large number of files and store them on the cloud. And I'm wondering if the following process would be secure (we have a “Hardware Security Module” ...
2
votes
0answers
41 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
2
votes
1answer
34 views

How can finding a collision help an attacker with tampering messages with HMAC

As stated in the HMAC RFC (RFC 2104): The strongest attack known against HMAC is based on the frequency of collisions for the hash function H. How can a collision benefit an attacker? I would ...
2
votes
2answers
71 views

Block-cipher based vs Hash based MAC

When it comes to MAC algorithms one can have many choices. CBC-MAC, CMAC, PMAC etc are some MAC algorithms that rely on block ciphers (ex AES) to generate a MAC. On the other hand HMAC is very popular ...
2
votes
1answer
74 views

Are there any cryptographic flaws in my webhook signing process?

Out of band my services have exchanged secret keys. These secret keys are then used to prevent two things of the webhooks (HTTP calls triggered by Service A to Service B when an event occurs in ...
6
votes
1answer
104 views

Is HMAC-SHA-1 secure?

Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
3
votes
2answers
90 views

Combining two keys

What is the most secure way to combine two "random" keys X of size k (k ≤ 512 bits) and Y of size 512 bits in one key Z of size k? Result Z will be used for encryption/decryption with various ...
2
votes
1answer
152 views

CMAC vs HMAC security strength

From the perspective of a Birthday Paradox attack, isn't it true that CMAC based on AES-128 is weaker than HMAC-SHA-1? The attack on CMAC-AES-128 requires about $2^{64}$ operations whereas the same ...
1
vote
1answer
135 views

A way around digital signatures?

Scenario: I have to protect the integrity of some files that will be exchanged between entities $A$, $B$, $C$. Entity $A$ creates the file (e.g. configuration) and sends it to $B$ and $C$. Entities ...
4
votes
1answer
81 views

Key Derivation from random salted seed, HMAC and HMAC based KDF

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
1
vote
1answer
50 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
4
votes
1answer
58 views

Are HMACs based on hashes with larger bit-lengths also more secure?

When doing encrypt-then-mac, I can choose to use a hmac as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC. Does it increase ...
3
votes
1answer
113 views

Does adding a salt to the message before HMAC processing add any security?

An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function ...
3
votes
2answers
268 views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
2
votes
3answers
114 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
1
vote
0answers
47 views

key-exchange with websockets in node.js

I do not see how someone would distribute a “key/key agreement” without exposing it to a MITM! I would consider it to be strange if the answer is “via a HTTPS or TLS connection” because – if this is ...
2
votes
1answer
59 views

Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions. I am interested in what bcrypt does to the ...
5
votes
1answer
151 views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
0
votes
0answers
54 views

What are the consequences of not checking the server mac in a TLS connection?

The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU However, I want to make it clear that you don't have to ...
3
votes
1answer
121 views

AES-128-CTR message integrity: Construction of HMAC

(Note: This post is not about "rolling my own", but rather trying to deepen my understanding of the underlying structures.) I'm having difficulties finding clear answers to some questions about the ...
2
votes
1answer
65 views

Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?

In a recent question I asked here on crypto.se, an answer was given that surprised me a bit. As mentioned in the referenced question, I'm looking to derive encryption and authentication keys from ...
0
votes
1answer
157 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
2
votes
0answers
125 views

HMAC-SHA1 vs HMAC-SHA256 for data storage

Reading the question “HMAC-SHA1 vs HMAC-SHA256”, I figured out that the known attacks on SHA1 don't apply to its HMAC version. So, HMAC-SHA1 is quite strong right now. In a protocol like SSL, if it ...
7
votes
1answer
137 views

Can Skein be used as a secure MAC in format H(k || m)?

Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
15
votes
1answer
290 views

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where ...
2
votes
2answers
101 views

Is HMAC necessary if the AES ciphertext of a message includes the CRC of the message?

I've seen that encrypting an image with AES-CBC then calculating the HMAC-MD5 value for authentication is a somewhat common and sound way to secure data. Alternatively, can I just calculate the CRC of ...
3
votes
1answer
152 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
3
votes
0answers
69 views

HMAC definition by using only one key

Suppose $H$ is a hash function; why is $H(k||H(k||m))$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $H(k_1 ||H(k_2 ||m))$ . Why don't we use ...
7
votes
1answer
519 views

Use cases for CMAC vs. HMAC?

Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is ...
2
votes
1answer
130 views

Why does HMAC need a fixed length padding?

As everybody knows in order to calculate HMAC we have to concatenate padding to the message. I am just curious why the padding needs to be fixed-length. Why do we need the blocksize parameter here? ...
2
votes
0answers
106 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
3
votes
1answer
62 views

Does displaying HMAC hashes of user inputs compromise the HMAC validation?

Here is the scenario: "SECRET" is a secret key that is kept private and only used in this one application. The application allows users to enter in any "VALUE" (within various open-ended limits such ...
1
vote
0answers
132 views

For a one-time pad, which MAC method is information-theoretically secure?

In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
2
votes
1answer
1k views

HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough ...
2
votes
2answers
180 views

Private RSA key for HMAC key

I am creating software tokens for future request authentication, and I want to use an HMAC for the token to make them tamper-resistant. To ensure I can check the HMAC later I need a secret, persistent ...
4
votes
2answers
457 views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is ...
2
votes
0answers
68 views

How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ...
1
vote
1answer
106 views

Why concatenate the key a second time in HMAC? [duplicate]

On Wikipedia it is said that HMAC is basically (without taking into account padding): $H(key\ \Vert\ H(key\ \Vert\ message))$ where $\Vert$ denotes concatenation. I understand the need to hash ...
1
vote
1answer
149 views

What is the best way to share a shared secret key over HTTPS to be used for HMAC authentication?

I am writing an application in Java that will be using SHA-1 HMAC message authentication. From what I understand, a connection over HTTPS is considered secure enough to share a secret key in plain ...
1
vote
0answers
76 views

Does “use of SHA-256 in cryptography” imply use of SHA-256 both in HMAC and DH key exchange, assuming these are the only uses of hash in system? [closed]

I am beginner to Cryptography. And recently I came across the requirement like "use of SHA-256 in cryptography". Does "use of SHA-256 in cryptography" imply use of SHA-256 both in HMAC and DH key ...
1
vote
0answers
64 views

Why don't we use H(m||k) as a MAC? [duplicate]

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work. Is there some other obvious attack?
4
votes
1answer
239 views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
2
votes
1answer
159 views

Is it necessary to use single hash function for signature generation and HMAC?

I am trying to figure out if we need to use single hash function across all the places in a ssh session. i.e – signature generation/verification and HMAC calculation/validation. Is it possible to use ...
3
votes
2answers
273 views

Breaking a PRNG Scheme

Assume the following scheme for a PRNG generating decimals in [0,100) Given a message and a key, compute tag := HMAC512(message, key). Take the first 5 hexadecimal characters of the tag. If the ...
2
votes
1answer
70 views

Keyed-hash of a lot of small numbers

Let's say I have a list of several million numbers, with only 6-9 digits of secret information per number (this means that an attacker might efficiently guess the other digits). I have to store the ...
1
vote
1answer
205 views

Using HMAC-SHA256 with short passwords and sliced outputs for short-lived secure hashing

I don't have much background in cryptography, so forgive me if I'm using the wrong mathematical terms to explain my needs. Following this question, I learned that taking a random secret 16-bytes ...
11
votes
2answers
257 views

Can I use HMAC-SHA1 in counter mode to make a stream cipher?

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ...
4
votes
1answer
280 views

How does the secret key in an HMAC prevent modification of the HMAC?

Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course. When using Hash-based message authentication codes, I understand that ...