HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
13
votes
2answers
595 views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
11
votes
3answers
267 views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
10
votes
1answer
350 views
Security of N bit HMAC
Lets say that I am using 128 bit HMAC. How many operations are needed to find "non secure" message. Is birthday attack possible?
9
votes
2answers
277 views
Why is the salt used only once in PBKDF2, while the password is used often?
The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
9
votes
1answer
185 views
Which MACs can be converted into a secure unkeyed hash function?
It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
8
votes
1answer
224 views
Is Encrypt+HMAC stronger than AEAD?
There are a few posts that I've come across that seem to infer that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes.
...
7
votes
4answers
301 views
Can I determine if a user has the wrong symmetric encryption key?
We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
6
votes
1answer
263 views
Why does a broken hash function undermine an HMAC?
For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
6
votes
2answers
114 views
When using HMAC, does key encoding matter?
Given:
H is a good hash function with block size L.
K is a key of length >= L (recommended by RFC 2104).
Khex and Kbase64 are ASCII encodings of K.
In the HMAC algorithm, is there a good reason to ...
5
votes
1answer
2k views
HMAC vs MAC functions
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.
What are principle differences?
When to use one and when the other?(Typical Use Cases)
5
votes
3answers
357 views
How to authenticate over open channel?
I am making an arduino project to open my garage door. I want to make it so users with the passphrase can open the door. Due to computational restrictions it is unlikely encryption is possible. ...
5
votes
2answers
813 views
What are advantages of using a HMAC over RSA with SHA-1 hashes?
I am currently studying for an exam and this was a previous question:
Give one advantage of using HMACs over using RSA to sign SHA-1 hashes.
My thoughts are that it has something to do with the ...
5
votes
2answers
185 views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST ...
5
votes
2answers
175 views
Is my HMAC secure if I have a complete series of HMAC'd prefix strings
Let's say I have a long sentence, like "The quick brown fox jumped over the lazy dog." Let's further say that I need to keep this string encrypted, so I use an HMAC. Let's further further say I want ...
4
votes
1answer
141 views
HMAC for short messages
I am using HMAC (hmac-sha256 to be precise) message authentication without encryption. My question is, is having a short message make it easy to determine what my secret key is?
My C# code is as ...
4
votes
1answer
76 views
Security for IV in AES-GCM mode
I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the ...
4
votes
1answer
123 views
Future-Proof Versioning and Validation
I am working on a library (using standard primitives: AES256 CTR; HMAC with SHA256; PBKDF2 with SHA256, 128 bit salt, and 10000 rounds) to encrypt and decrypt data, given a password.
The encrypted ...
4
votes
2answers
150 views
Is this streamable combination of encryption and MAC secure?
I want to combine encryption and MAC.
For encryption I use AES-256 with CBC and PKCS5Padding.
For MAC I use HmacSHA512.
I use the Encrypt-then-Mac approach (calculate MAC over the ciphertext and ...
3
votes
2answers
162 views
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme
Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme?
Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
3
votes
3answers
138 views
What is the difference between a HMAC and a hash of data?
On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.
What exactly is the difference between an HMAC and a hash of a ...
3
votes
3answers
483 views
Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure?
I am developing a symmetric en-/decryption routine written in c# for a database containing user-specific, sensitive information.
I have narrowed down the implementation to 3 different approaches, ...
3
votes
2answers
139 views
RSA digital signature vs authenticated cipher
I want to provide both confidentiality and integrity for data at rest (many large files stored on disk).
I plan to encrypt the data using AES, which will cover the confidentiality requirement.
So ...
3
votes
1answer
122 views
Alternatives to HMAC + CBC?
I'm looking at using HMAC + CBC. The combination looks like this:
ciphertext = AES256(text, k1)
data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext
Where:
...
3
votes
1answer
124 views
DIfferent inner and outer hash functions for NIST Recommended HMAC?
The NIST recommended HMAC uses
$$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$
Is it ...
3
votes
1answer
61 views
Is the mod_auth_tkt scheme secure?
The third-party Apache plugin mod_auth_tkt uses a tragically-not-HMAC construction:
...
3
votes
1answer
190 views
Undecrypt using the OpenSSL EVP API?
I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation.
When using AES-256-CBC on the two sides, it's important ...
3
votes
1answer
194 views
Memory-hard operations in work-factor hash functions
I'm playing around with work-factor hash functions, and I'm looking for a memory-hard operation to make it resistant to GPU / parallel hardware attacks. I considered a very large (i.e. 64K) s-box that ...
2
votes
2answers
327 views
What is the difference between MAC and HMAC?
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
2
votes
2answers
75 views
Case insensitive verification of HMAC / Base64 signature
I am signing a short message using the base64 of an HMAC, like this (python):
...
2
votes
2answers
113 views
Does knowledge of original file size provide a cryptographic weakness?
I'm encrypting files using an AES-256 CBC cipher and an SHA-256 HMAC every 64KB in the file. Since AES CBC needs an amount of input bytes to be divisible by 16, I use PKCS#7 padding to bring the ...
2
votes
2answers
119 views
HMAC and assumptions on the cryptographic hash
According to Wikipedia, a cryptographic hash function has the following properties:
Pre-image resistance: Given $h$, it's difficult to find any message $m$ such that $h = H(m)$.
Second pre-image ...
2
votes
1answer
125 views
Is this algorithm secure?
I recently found this site, proposing a hashing algorithm for passwords.
They describe the following:
pad the password on both sides with SHA1(email) to ...
2
votes
1answer
205 views
SHA256 HMAC brute force with chosen plaintext attacks
This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key
I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...
2
votes
1answer
190 views
What are the safe ways to derive HMAC key using block cipher?
Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is ...
2
votes
1answer
86 views
What information to include when calculating the HMAC of ciphertext
I'm aware that it's crucial to include the IV when calculating the HMAC of a ciphertext (assuming an IV is used). Can anyone explain, in simple terms, why this is?
Furthermore, assume that there is ...
2
votes
1answer
122 views
Is it considered insecure in an HOTP implementation to publicly provide the next counter?
I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
2
votes
0answers
110 views
Single-purpose symmetric encryption scheme for single files
I'm writing a simple password manager program that will encrypt/decrypt a single file (it's size will most likely stay under a few K). This is my initial file format design:
...
1
vote
1answer
94 views
Brute forcing an HMAC
Given current technology such as GPUs and GPU cracking software I was wondering if anyone has an idea on how long it would take to brute force the key used to derive an HMAC?
1
vote
2answers
148 views
Is it worth applying a MAC on data in a HSM?
I'm building a basic HSM out of an Arduino, and am using the following scheme to store data:
Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction).
Secondary ...
1
vote
2answers
249 views
AES+CTR+HMAC Encryption and Authentication on an Arduino
In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel.
We have chosen AES in CTR ...
1
vote
1answer
161 views
ID-Secret Scheme
I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present.
Party 1 and Party 2 hold some credentials, an ID and a Secret.
Party 1 Creates this message:
...
1
vote
2answers
78 views
How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?
I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars.
...
1
vote
2answers
170 views
Deriving HMAC key and cipher key from passphrase? [duplicate]
I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
0
votes
2answers
101 views
Recommended authenticated stream cipher for minimum overhead?
I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet.
This causes quite a bit of space overhead for small packets, so at first I ...
0
votes
0answers
50 views
why these specific values used to initialize ipad & opad in HMAC [duplicate]
Possible Duplicate:
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
I'm reading the book Network Security Essentials written by William Stallings.
in this book,in ...
0
votes
0answers
38 views
hmac sign data or cipher? [duplicate]
Possible Duplicate:
Should we MAC-then-encrypt or encrypt-then-MAC?
Ok, this may be a dumb question but I'm wondering, with an HMAC signature of a ciphertext should I be signing the data ...
-1
votes
2answers
80 views
HMAC collision probability bounds
Could someone point to results or proofs about the probability of HMAC(k, m1) = HMAC (k, m2), assuming the underlying hash function is SHA-256? Would those probabilities be higher/lower if m1 and m2 ...
-2
votes
1answer
62 views
Cryptographic Primitive Method
Is there any cryptographic primitive bijective (one-to-one and onto) function for creating cryptographic tools like symmetric encryption/decryption, Hash code generator, MAC, HMAC and Random number ...
-3
votes
1answer
96 views
With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$? (Assume that $k$ was chosen at random.)
