HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

learn more… | top users | synonyms

2
votes
2answers
135 views

Is HMAC necessary if the AES ciphertext of a message includes the CRC of the message?

I've seen that encrypting an image with AES-CBC then calculating the HMAC-MD5 value for authentication is a somewhat common and sound way to secure data. Alternatively, can I just calculate the CRC of ...
3
votes
0answers
72 views

HMAC definition by using only one key

Suppose $H$ is a hash function; why is $H(k||H(k||m))$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $H(k_1 ||H(k_2 ||m))$ . Why don't we use ...
7
votes
1answer
761 views

Use cases for CMAC vs. HMAC?

Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is ...
10
votes
1answer
658 views

Security of N bit HMAC

Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?
2
votes
1answer
168 views

Is it necessary to use single hash function for signature generation and HMAC?

I am trying to figure out if we need to use single hash function across all the places in a ssh session. i.e – signature generation/verification and HMAC calculation/validation. Is it possible to use ...
2
votes
1answer
259 views

Why does HMAC need a fixed length padding?

As everybody knows in order to calculate HMAC we have to concatenate padding to the message. I am just curious why the padding needs to be fixed-length. Why do we need the blocksize parameter here? ...
2
votes
0answers
123 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
3
votes
1answer
64 views

Does displaying HMAC hashes of user inputs compromise the HMAC validation?

Here is the scenario: "SECRET" is a secret key that is kept private and only used in this one application. The application allows users to enter in any "VALUE" (within various open-ended limits such ...
4
votes
1answer
4k views

HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough ...
2
votes
2answers
222 views

Private RSA key for HMAC key

I am creating software tokens for future request authentication, and I want to use an HMAC for the token to make them tamper-resistant. To ensure I can check the HMAC later I need a secret, persistent ...
4
votes
2answers
840 views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is ...
2
votes
0answers
78 views

How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ...
1
vote
1answer
127 views

Why concatenate the key a second time in HMAC? [duplicate]

On Wikipedia it is said that HMAC is basically (without taking into account padding): $H(key\ \Vert\ H(key\ \Vert\ message))$ where $\Vert$ denotes concatenation. I understand the need to hash ...
1
vote
0answers
80 views

Does “use of SHA-256 in cryptography” imply use of SHA-256 both in HMAC and DH key exchange, assuming these are the only uses of hash in system? [closed]

I am beginner to Cryptography. And recently I came across the requirement like "use of SHA-256 in cryptography". Does "use of SHA-256 in cryptography" imply use of SHA-256 both in HMAC and DH key ...
1
vote
0answers
66 views

Why don't we use H(m||k) as a MAC? [duplicate]

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work. Is there some other obvious attack?
3
votes
2answers
282 views

Breaking a PRNG Scheme

Assume the following scheme for a PRNG generating decimals in [0,100) Given a message and a key, compute tag := HMAC512(message, key). Take the first 5 hexadecimal characters of the tag. If the ...
2
votes
1answer
202 views

Is this new server API authentication protocol secure?

I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ...
2
votes
1answer
72 views

Keyed-hash of a lot of small numbers

Let's say I have a list of several million numbers, with only 6-9 digits of secret information per number (this means that an attacker might efficiently guess the other digits). I have to store the ...
5
votes
1answer
374 views

How does the secret key in an HMAC prevent modification of the HMAC?

Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course. When using Hash-based message authentication codes, I understand that ...
2
votes
1answer
62 views

Using HMAC to secure a “widget”

Let's say I have a web "widget" that a customer could include on their website. They would include the widget by adding an iframe that points to a URL on my site. I want to ensure that my widget can ...
1
vote
2answers
268 views

Game traffic encryption AES CTR + HMAC

I was asked to implement traffic encryption between the game server and clients. Currently, the traffic is not encrypted in any way, which lets players use cheats to listen to the traffic in order to ...
1
vote
0answers
74 views

When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
1
vote
0answers
200 views

Is there any analysis of freebsd's “geli” encrypted geometry provider?

I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
0
votes
1answer
221 views

Why does WPA2-PSK use 4-way handshake instead of 2-way handshake

I don't seem to grasp why is the handshake for PTK in WPA2-PSK 4-way and not 2-way. Isn't it enough to just have these two steps: First party sends Nonce1 to the other party Second party sends to ...
1
vote
1answer
2k views

What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos?

I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ...
1
vote
1answer
114 views

Encrypted query parameters via HMAC

I have an unsubscribe link, which needs to be passed a customer id, and a product id, producing a query string something like: ?cid=100&pid=2 I would like to ...
1
vote
3answers
1k views

How to use HMAC-SHA1, HMAC-SHA2 in conjunction with AES

I understand how to compute HMAC-SHA1, HMAC-SHA2 etcetera. Please explain why/how is the resulting HMAC value is used in conjunction with AES for encryption/decryption and signing/verifying. In ...
0
votes
2answers
951 views

HMAC vs Encrypted Hash

What is best to use (for message integrity) between… AES(Data) + HMAC(Data) AES(Data + HMAC(Data)) AES(Data + Hash(Data)) …and why?
2
votes
0answers
85 views

How does use of HMAC affect hash function combiners?

In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions: $HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus ...
5
votes
1answer
229 views

HMAC construction based on the combination of two hash functions

I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of ...
1
vote
2answers
172 views

Can you get two unpredictable hashes from the same message with, e.g. SHA1?

I'd like to create a database of questions and answers so that an attacker with access to the database can't obtain either the questions or the answers. If H0 and ...
1
vote
1answer
2k views

HMAC SHA256 vs RSA SHA256 - which one to use

Salesforce recently announced they are moving away from HMAC SHA256 to RSA SHA256. Why did they make that move?. Any technical factors? Is HMAC really easy to break? ...
2
votes
1answer
122 views

Is it possible to find a preimage for a reduced size hash?

Given a message $M$ and a 256 bit key $K$, perform HMAC($K$, $M$) with a 256 bit hash function resulting in: $a$ = ...
1
vote
5answers
1k views

Using one-way hash functions as the encryption method

Suppose two parties want to communicate securely with each other (Bob and Alice) using a simple messaging system in English. There are approximately 180,000 currently used words in the English ...
3
votes
1answer
684 views

HMAC-SHA1 input size

I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for ...
6
votes
2answers
400 views

Why are HOTP and TOTP implementations all using 6 digits and not more?

I was checking the RFC's after wondering for some time. In RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm, it states on the appendix: A simple enhancement in terms of security would be ...
3
votes
1answer
231 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
9
votes
1answer
2k views

Is HMAC-MD5 considered secure?

I've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash. Does that mean that something like HMAC-MD5 still might be considered ...
2
votes
1answer
140 views

The probability of finding a limited set of collisions for HMACSHA256

I need some input on the use of HMAC-SHA256 in an open source project, any help appreciated. The problem I'm solving is session fixation. We have a username, for that username we'd like to generate a ...
1
vote
1answer
159 views

Securely generating passwords based on a secret and a public identifier

I'm trying to create a good scheme for generating passwords in my systems management scripts. What I'd like to do is have a secret key (let's say hello123), which I ...
10
votes
1answer
319 views

Which MACs can be converted into a secure unkeyed hash function?

It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
0
votes
2answers
256 views

Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...
2
votes
1answer
249 views

Is it considered insecure in an HOTP implementation to publicly provide the next counter?

I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
6
votes
2answers
321 views

When using HMAC, does key encoding matter?

Given: H is a good hash function with block size L. K is a key of length >= L (recommended by RFC 2104). Khex and Kbase64 are ASCII encodings of K. In the HMAC algorithm, is there a good reason to ...
2
votes
2answers
234 views

HMAC and assumptions on the cryptographic hash

According to Wikipedia, a cryptographic hash function has the following properties: Pre-image resistance: Given $h$, it's difficult to find any message $m$ such that $h = H(m)$. Second pre-image ...
-2
votes
1answer
420 views

With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?

Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$? (Assume that $k$ was chosen at random.)
2
votes
1answer
147 views

Is this algorithm secure?

I recently found this site, proposing a hashing algorithm for passwords. They describe the following: pad the password on both sides with SHA1(email) to ...
3
votes
1answer
306 views

Alternatives to HMAC + CBC?

I'm looking at using HMAC + CBC. The combination looks like this: ciphertext = AES256(text, k1) data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext Where: ...
2
votes
2answers
133 views

Does knowledge of original file size provide a cryptographic weakness?

I'm encrypting files using an AES-256 CBC cipher and an SHA-256 HMAC every 64KB in the file. Since AES CBC needs an amount of input bytes to be divisible by 16, I use PKCS#7 padding to bring the ...
3
votes
1answer
1k views

SHA256 HMAC brute force with chosen plaintext attacks

This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...