HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

learn more… | top users | synonyms

4
votes
1answer
68 views

Is it wise to use HOTP (raw bytes) as a key for HMAC?

Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared ...
2
votes
2answers
72 views

Is the security of an HMAC equally important as the security of the cipher itself?

I'm a little unclear on how hash based MAC works... So I would like to know, is the security of your hash function as important as the security of the overall cipher? Basically, if you can crack the ...
1
vote
0answers
41 views

Keys and key-stretching when authenticating requests?

I'm making a REST application and still a bit confused about this issue. basically, to authenticate incoming requests, I give out userId, issued timestamp, expiry timestamp (normally 3 months after ...
1
vote
1answer
69 views

Why does NaCl's crypto_auth have twice the security level of crypto_onetimeauth?

The crypto_auth function produces a 256-bit HMAC, with a 512-bit version also available. But the crypto_onetimeauth function ...
6
votes
1answer
279 views

What size should the HMAC key be with SHA-256?

I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters. What is the ironclad rule ...
1
vote
1answer
65 views

PBEWithMD5AndDES Cipher does not check for integrity first?

I am running FindBugs with findsecbugs plugin to scan java code for security issues. I am getting "Cipher With No Integrity" error for a Cipher function implemented with "PBEWithMD5AndDES". The legend ...
4
votes
1answer
68 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
4
votes
2answers
115 views

Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ...
-1
votes
1answer
34 views

Execution time for HMAC-MD5 on a 160 bit data using 128 bit key on a 3GHz CPU [closed]

I need to know the execution time for HMAC -MD5 for a 160 bit data using 128 bit key on a 3 Ghz CPU, kindly specify other parameters of the machine like RAM, operating system used etc
4
votes
1answer
101 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
2
votes
1answer
37 views

Should I authenticate memory data which was loaded from authenticated disk file?

Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to ...
2
votes
1answer
466 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
2
votes
1answer
121 views

Is it an overkill to add external integrity check to the AES-GCM encoding?

There is a java library for android which implements integrity checking to predefined encrypting mode(which can be found here). Short class description from author page to avoid further questions ...
1
vote
1answer
232 views

Encrypt large data with RSA through blocks in java

I'm working on a communication protocol where a client sends encrypted data to a server. What happens is that in some point, the client creates a symmetric key used to create data digests through the ...
6
votes
2answers
661 views

HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
2
votes
0answers
70 views

If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

Say we construct a pseudo-random number generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back ...
0
votes
1answer
70 views

Is a nonce considered 'secret' enough for HMAC?

We're implementing a mobile application which communicates with a web service, and on first install the user sends its deviceid to the web service (over TLS, unauthenticated at this point) - which ...
1
vote
1answer
5k views

What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos?

I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ...
1
vote
1answer
45 views

Is it possible to have self-authenticated message?

Consider a text with $n$ words which $m$ words of it can be replaced with an equivalent word. Therefore we have $2^m$ different texts with the same meaning. For example "You are {so/very} ...
3
votes
2answers
189 views

HMAC key storage for a web app?

If one is going to use an HMAC, I.E: http://php.net/manual/en/function.hash-hmac.php, where exactly are they storing the key? Without some sort of secure storage (i.e not in a local file or code), I ...
4
votes
1answer
114 views

Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed: ...
5
votes
2answers
424 views

Why do cryptographic hashes need to be fixed length?

Why do cryptographic hashes need to have a fixed length output? I know that the shallow answer is that an output that varies by key size or file size can leak information somehow, leading to ...
1
vote
1answer
75 views

How to key an HMAC with keys from separate mutually untrusted parties?

The problem is as follows: There are two parties, both of whom would like to HMAC a message with a key. Although the keys are known to one another, both parties do not trust that the other one ...
3
votes
1answer
136 views

Double randomised HMAC verification to prevent timing attack

A way to prevent timing attacks for hash string comparison is to perform additional HMAC signing in order to randomize the verification process (see Double HMAC Verification). In addition to the ...
3
votes
1answer
63 views

Avoiding replay attack on certified announcements

Suppose two agents A and B share a common secret and A makes a regular unique 16-byte ...
3
votes
1answer
192 views

HMAC-SHA256 on large data files

I currently need to encrypt large files (video, over 6 Gbytes) for our customers. To ensure authenticity and integrity, we chose HMAC-256 as we already use it in our internal messaging system. But ...
2
votes
1answer
742 views

How to implement HMAC SHA-256

I am trying to figure out how the HMAC SHA-256 hashing algorithm works. I know that we have to use the following: H (K ^ opad)|| H ((K ^ ipad)|| text)). The ...
1
vote
1answer
123 views

How is wpa2 authentication structured

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to ...
1
vote
1answer
39 views

For the scrypt HMAC storage format, why run the input of the hash and the hash itself into the HMAC

Generally if the body is hashed, why provide the body and the hash as input into the HMAC. Instead wouldn't the same security be achieved by hashing the body and providing only the hash as input into ...
2
votes
2answers
49 views

Is it secure to use TOTP with same key and different time-counters?

If I use TOTP to generate codes with different "expiration" time, using the same key for HMAC, will I create some kind of weakness?
2
votes
2answers
72 views

Is it safe to use single-block AES for mutual authentication?

I read the question Symmetric mutual authentication with client using a derived secret and its answer which, if I'm not mistaken, assert that it should be safe to use the proposed protocol for mutual ...
1
vote
1answer
43 views

Digital signatures using a partially public key

I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices. To ...
1
vote
1answer
91 views

Chance to find HMAC key/salt when having knowledge of the hashed data?

I'm not sure how to word this... I'm working with a HMAC (I think of it being a "salted hash"). I know the entire string being hashed, I do NOT know the salt. I also know the first 8 characters of the ...
1
vote
1answer
78 views

Is this scheme to derive multiple keys secure?

I need a cryptographic scheme to generate a deterministic chain of private keys that look random to outside observer but can always be reconstructed from a single root key, also: Neither private ...
6
votes
1answer
337 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
2
votes
1answer
971 views

HMAC-SHA1 vs HMAC-SHA256 for data storage

Reading the question “HMAC-SHA1 vs HMAC-SHA256”, I figured out that the known attacks on SHA1 don't apply to its HMAC version. So, HMAC-SHA1 is quite strong right now. In a protocol like SSL, if it ...
3
votes
1answer
114 views

Is this a proper PBKDF2 key derivation function algorithm?

I've started implementing PBKDF2 algorithm recently and since I'm new in crypto, I would like to ask if my implementation is good. I looked up some documentations and I tried to follow many of them ...
3
votes
3answers
4k views

How to use HMAC-SHA1, HMAC-SHA2 in conjunction with AES

I understand how to compute HMAC-SHA1, HMAC-SHA2 etcetera. Please explain why/how is the resulting HMAC value is used in conjunction with AES for encryption/decryption and signing/verifying. In ...
1
vote
1answer
184 views

How does the HOTP dynamic truncation function generalize to longer hashes?

HOTP, the HMAC-based One-Time Password algorithm from RFC 4226, uses a "dynamic truncation" function to turn the 20 byte HMAC-SHA-1 value into a 31 bit string. The dynamic truncation (from Section ...
1
vote
1answer
121 views

Two rounds of SHA-256 HMAC?

In a project we are working on, we have two applications within our datacenter that exchange messages. The messages are protected by an HMAC, and the secret key is stored on a SafeNet device. Update ...
4
votes
2answers
98 views

A periodic PRNG based on hash function?

I need a PRNG which provides 128 bytes numbers. Let's say that given a symmetric key $K$ and an internal state $s$ I use the PRF HMAC-SHA512 this way: The output is PRNG($K, s$) = ...
2
votes
1answer
100 views

Is a 256 bit HMAC-SHA256 key compromised if the tail is used for identification?

Using a truncated hash of a key seems to be a safe way to identify the key (i.e. key fingerprint), but what about truncating a key itself in the case of HMAC-SHA256? Example: ...
7
votes
2answers
357 views

Is calculating HMAC from hashed input a good idea?

Original HMAC algorithm is as follows: H(K XOR opad || H(K XOR ipad || text)) What if text would replaced with H(text)? ...
16
votes
2answers
19k views

HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough ...
6
votes
2answers
600 views

Block-cipher based vs Hash based MAC

When it comes to MAC algorithms one can have many choices. CBC-MAC, CMAC, PMAC etc are some MAC algorithms that rely on block ciphers (ex AES) to generate a MAC. On the other hand HMAC is very popular ...
2
votes
2answers
96 views

SHA256_HMAC for deriving session keys using a counter

I need to generate some session keys from a master key that was generated from an ECDH key exchange. The master key is 256 bits and I need 256 bit sessions keys. Is it safe to use SHA256_HMAC with ...
0
votes
2answers
90 views

How is the MAC or HMAC secret shared with the other party for verification?

I've seen people everywhere say to use a MAC or HMAC with block ciphers. I think I understand the basics, but I'm still not sure how the HMAC secret is distributed so the other party can verify that ...
2
votes
0answers
134 views

When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
3
votes
2answers
345 views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, ...
5
votes
1answer
147 views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...