HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

learn more… | top users | synonyms

4
votes
1answer
286 views

Undecrypt using the OpenSSL EVP API?

I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation. When using AES-256-CBC on the two sides, it's important ...
4
votes
1answer
172 views

Key Derivation from random salted seed, HMAC and HMAC based KDF

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
4
votes
0answers
174 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
3
votes
5answers
2k views

Using one-way hash functions as the encryption method

Suppose two parties want to communicate securely with each other (Bob and Alice) using a simple messaging system in English. There are approximately 180,000 currently used words in the English ...
3
votes
2answers
417 views

Case insensitive verification of HMAC / Base64 signature

I am signing a short message using the base64 of an HMAC, like this (python): ...
3
votes
1answer
1k views

HMAC-SHA1 input size

I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for ...
3
votes
2answers
2k views

How does SafeNet MobilePASS generate passwords?

We use MobilePASS at work but the latest version of the android client seems to be buggy so I wanted to have a go at implementing the algorithm myself. You can download the client to play with here: ...
3
votes
1answer
1k views

Brute forcing an HMAC

Given current technology such as GPUs and GPU cracking software I was wondering if anyone has an idea on how long it would take to brute force the key used to derive an HMAC?
3
votes
2answers
313 views

Breaking a PRNG Scheme

Assume the following scheme for a PRNG generating decimals in [0,100) Given a message and a key, compute tag := HMAC512(message, key). Take the first 5 hexadecimal characters of the tag. If the ...
3
votes
1answer
2k views

SHA256 HMAC brute force with chosen plaintext attacks

This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...
3
votes
2answers
835 views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. So ...
3
votes
2answers
313 views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, ...
3
votes
1answer
312 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
3
votes
1answer
182 views

DIfferent inner and outer hash functions for NIST Recommended HMAC?

The NIST recommended HMAC uses $$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$ Is it ...
3
votes
2answers
48 views

A periodic PRNG based on hash function?

I need a PRNG which provides 128 bytes numbers. Let's say that given a symmetric key $K$ and an internal state $s$ I use the PRF HMAC-SHA512 this way: The output is PRNG($K, s$) = ...
3
votes
1answer
53 views

Is there any good reason to chain HMACs in this manner?

I am looking at some decompiled Java code from an Android app. As a security measure, a signature is passed as a parameter to a number of JSON requests. The method that generates the signature is as ...
3
votes
1answer
207 views

Does adding a salt to the message before HMAC processing add any security?

An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function ...
3
votes
1answer
121 views

Is the mod_auth_tkt scheme secure?

The third-party Apache plugin mod_auth_tkt uses a tragically-not-HMAC construction: ...
3
votes
2answers
112 views

How many times can a key be used for HMAC-SHA256 before it needs to be rotated?

If I wanted to use hmac for proving that a value hadn't been tampered with, how many times can I use a key before it needs to be rotated?
3
votes
1answer
164 views

PBKDF2 Salt and Password Ordering

I am currently reading about PBKDF2, and understand that the salt is used only once, while the password is used multiple times in the computation of the final key (see this question). How would the ...
3
votes
1answer
190 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
3
votes
1answer
78 views

Does displaying HMAC hashes of user inputs compromise the HMAC validation?

Here is the scenario: "SECRET" is a secret key that is kept private and only used in this one application. The application allows users to enter in any "VALUE" (within various open-ended limits such ...
3
votes
1answer
190 views

AES-128-CTR message integrity: Construction of HMAC

(Note: This post is not about "rolling my own", but rather trying to deepen my understanding of the underlying structures.) I'm having difficulties finding clear answers to some questions about the ...
3
votes
1answer
282 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
0answers
101 views

HMAC definition by using only one key

Suppose $H$ is a hash function; why is $H(k||H(k||m))$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $H(k_1 ||H(k_2 ||m))$ . Why don't we use ...
2
votes
1answer
467 views

CMAC vs HMAC security strength

From the perspective of a Birthday Paradox attack, isn't it true that CMAC based on AES-128 is weaker than HMAC-SHA-1? The attack on CMAC-AES-128 requires about $2^{64}$ operations whereas the same ...
2
votes
2answers
391 views

Why is HMAC-SHA1 still considered secure?

This Q & A http://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
2
votes
2answers
140 views

Does knowledge of original file size provide a cryptographic weakness?

I'm encrypting files using an AES-256 CBC cipher and an SHA-256 HMAC every 64KB in the file. Since AES CBC needs an amount of input bytes to be divisible by 16, I use PKCS#7 padding to bring the ...
2
votes
2answers
186 views

Generate secure password hashes without access to PBKDF2 or bcrypt

Given is a system, which does provide only implementations of fast hash algorithms (MD5, SHA1, SHA-256, SHA-512). There is no implementation of PBKDF2, bcrypt or scrypt available. The system does ...
2
votes
3answers
204 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
2
votes
1answer
223 views

Why concatenate the key a second time in HMAC? [duplicate]

On Wikipedia it is said that HMAC is basically (without taking into account padding): $H(key\ \Vert\ H(key\ \Vert\ message))$ where $\Vert$ denotes concatenation. I understand the need to hash ...
2
votes
2answers
282 views

HMAC and assumptions on the cryptographic hash

According to Wikipedia, a cryptographic hash function has the following properties: Pre-image resistance: Given $h$, it's difficult to find any message $m$ such that $h = H(m)$. Second pre-image ...
2
votes
1answer
152 views

Is this algorithm secure?

I recently found this site, proposing a hashing algorithm for passwords. They describe the following: pad the password on both sides with SHA1(email) to ...
2
votes
2answers
156 views

secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

The embedded device is a low-power 8-bit microcontroller (memory usage is constrained to about 10kb code, 1kb ram). As the device is battery-powered and manual service should be minimal, more powerful ...
2
votes
2answers
373 views

Private RSA key for HMAC key

I am creating software tokens for future request authentication, and I want to use an HMAC for the token to make them tamper-resistant. To ensure I can check the HMAC later I need a secret, persistent ...
2
votes
2answers
4k views

AES+CTR+HMAC Encryption and Authentication on an Arduino

In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ...
2
votes
1answer
141 views

New to cryptology, studying Message Authentication Codes

I understand the basic operational theory behind MAC, but I'm getting tripped up on some of the finer details. Also the differences between MAC, HMAC and MIC are getting lost on me, including the ...
2
votes
1answer
74 views

Can adding nonces make challenge response authentications weaker?

In a custom protocol we want to replace an aged tiger32 based challenge response authentication. I suggested that we use something existing, so threw HMAC into the room. As per wikipedia it works as: ...
2
votes
1answer
190 views

Securely generating passwords based on a secret and a public identifier

I'm trying to create a good scheme for generating passwords in my systems management scripts. What I'd like to do is have a secret key (let's say hello123), which I ...
2
votes
1answer
306 views

What are the safe ways to derive HMAC key using block cipher?

Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is ...
2
votes
2answers
183 views

PGP digital signature vs SHA256 HMAC Comparison

First let me admit that I am not a mathematician or a cryptographer. I am responsible for assisting in making a recommendation on a project that is consolidating payment processes within a company's ...
2
votes
1answer
73 views

Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions. I am interested in what bcrypt does to the ...
2
votes
2answers
260 views

Is HMAC necessary if the AES ciphertext of a message includes the CRC of the message?

I've seen that encrypting an image with AES-CBC then calculating the HMAC-MD5 value for authentication is a somewhat common and sound way to secure data. Alternatively, can I just calculate the CRC of ...
2
votes
1answer
573 views

Why does HMAC need a fixed length padding?

As everybody knows in order to calculate HMAC we have to concatenate padding to the message. I am just curious why the padding needs to be fixed-length. Why do we need the blocksize parameter here? ...
2
votes
1answer
194 views

Is it necessary to use single hash function for signature generation and HMAC?

I am trying to figure out if we need to use single hash function across all the places in a ssh session. i.e – signature generation/verification and HMAC calculation/validation. Is it possible to use ...
2
votes
1answer
80 views

Keyed-hash of a lot of small numbers

Let's say I have a list of several million numbers, with only 6-9 digits of secret information per number (this means that an attacker might efficiently guess the other digits). I have to store the ...
2
votes
1answer
216 views

The probability of finding a limited set of collisions for HMACSHA256

I need some input on the use of HMAC-SHA256 in an open source project, any help appreciated. The problem I'm solving is session fixation. We have a username, for that username we'd like to generate a ...
2
votes
1answer
171 views

What information to include when calculating the HMAC of ciphertext

I'm aware that it's crucial to include the IV when calculating the HMAC of a ciphertext (assuming an IV is used). Can anyone explain, in simple terms, why this is? Furthermore, assume that there is ...
2
votes
1answer
33 views

Is a 256 bit HMAC-SHA256 key compromised if the tail is used for identification?

Using a truncated hash of a key seems to be a safe way to identify the key (i.e. key fingerprint), but what about truncating a key itself in the case of HMAC-SHA256? Example: ...
2
votes
2answers
67 views

SHA256_HMAC for deriving session keys using a counter

I need to generate some session keys from a master key that was generated from an ECDH key exchange. The master key is 256 bits and I need 256 bit sessions keys. Is it safe to use SHA256_HMAC with ...