HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

learn more… | top users | synonyms

4
votes
0answers
41 views

Do we still need HMAC now that SHA3 is here? [duplicate]

In Another look at HMAC from Koblitz and Menezes, they state that HMAC came along because doing h(secret || message) was vulnerable to length extension attacks. But as far as I know, these kind of ...
7
votes
2answers
535 views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
0
votes
1answer
39 views

What is a simple information authentication protocol for constrained devices?

Background: I have an application where devices will poll information from some source on the network. These devices are very basic and have modest processing and memory capabilities. Hashing (and ...
1
vote
2answers
62 views

How secure is HMAC SHA256

I have a message (UUID) in this form 406a5830-2a6a-11e6-bdf4-0800200c9a66. I also use a secret key for example ...
13
votes
1answer
1k views

Security of N bit HMAC

Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?
4
votes
2answers
62 views

How long should a HMAC cryptographic key be?

In the top answer to this question the answerer says 'with a sufficently long key'. I am using a SHA1-HMAC (may switch to SHA256-HMAC) algorithm to verify cookies sent to clients as authentication ...
7
votes
2answers
215 views

Should HMAC-SHA3 be preferred over H(C(k,M))?

If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ...
3
votes
2answers
81 views

Why are MACs not included when defining Protocols?

I see often in literature related to cryptographic protocols that MACs (Message Authentication Codes) are not included in protocol definitions. For example: ...
0
votes
2answers
70 views

Encrypting using “Cryptography.HMACSHA1”, how to decrypt (VBA)

I have an encryption routine that works very well in VBA. But now I need to program the decryption routine, and I'm stuck. For encryption I'm using HMACSHA1 and transferring the encrypted byte to base ...
0
votes
0answers
28 views

PHP Apple News HASH HHMAC

I am having a problem generating the signature key in PHP as describred in the Apple nes API documentation found here: https://developer.apple.com/library/ios/documentation/General/Conceptual/...
4
votes
2answers
73 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
0
votes
1answer
91 views

Key derivation using the main AES encryption key and some plain text

I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text. I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text ...
14
votes
2answers
6k views

Is HMAC-MD5 considered secure for authenticating encrypted data?

I've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash. Does that mean that something like HMAC-MD5 still might be considered ...
3
votes
1answer
58 views

Do you need a HMAC if decryption attempts are severely limited?

I am considering an application where data bandwidth is extremely limited, and considering removing message authentication codes from encrypted transmissions. The encryption method is currently AES-...
5
votes
1answer
130 views

Key size for HMAC-SHA256 [duplicate]

After reading a bunch of past stack exchange posts like this one and RFCs 5869, 2104, and 4868 I felt comfortable that a 32-byte key was sufficient for HMAC-SHA256. However, I am implementing my code ...
1
vote
2answers
64 views

Parallel file encryption and authentication for large files

For a cloud storage upload client I want to encrypt files during upload, so that they cannot be read by the cloud service provider or anyone who gains access to the account. I would like to use some ...
3
votes
1answer
91 views

Deriving AES key and HMAC key from shorter master key

I am working in .NET and as far as I can tell the only choice for key derivation is PBKDF2-HMAC-SHA1. SHA1's output size is only 160 bits. But I am implementing authenticated encryption and thus ...
5
votes
1answer
57 views

What is the security strength of an n-bit HMAC?

HMACs depend on preimage resistance, or so I have read. The security strength of hash function with an $n$-bit output against collision attacks is $2^{\frac{n}{2}}$. Against preimage attacks, it is $2^...
5
votes
2answers
345 views

Is my HMAC secure if I have a complete series of HMAC'd prefix strings

Let's say I have a long sentence, like "The quick brown fox jumped over the lazy dog." Let's further say that I need to keep this string encrypted, so I use an HMAC. Let's further further say I want ...
0
votes
0answers
35 views

Length extension attacks or prefix attacks on HMAC

Why HMACs are not vulnerable to length extension attacks or prefix attacks? (As commented by @codesinchaos, That's a different construction. So it's related, but no duplicate of Why is H(message||...
4
votes
2answers
145 views

Encrypt-then-HMAC implementation - am I doing it right?

I want to implement authenticated encryption using C#. There is a dot net class called encryptAndAuthenticate, but it is only supported on windows 8 or later, and I need the code to also work on ...
1
vote
1answer
164 views

Is the result of HMAC-sha256 distinguishable from random noise?

Is if the result of HMAC-sha256 distinguishable from random noise? If so, given: a collection of 1000 keys, and 1000 messages of random noise, 100 signed by each of only 10 of those keys Can ...
0
votes
3answers
115 views

About MAC and HMAC

I'm studying mechanisms of integrity and authentication in symmetric encryption scenarios. I want to propose some examples to see whether I got the point here: Let $m$ be the message, $c$ the ...
1
vote
1answer
231 views

HMAC Secure Key Exchange?

Within RFC 2104 section 3 there is discussion around keys (below). How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute ...
3
votes
1answer
36 views

Is this session start protocol secure?

I am working on a password manager application that saves the user's passwords in a remote server. I need to use AES in CTR mode to encrypt the passwords before sending them to the server. The client ...
3
votes
1answer
41 views

The solution of insert MAC in a ciphertext without Authenticated Encryption supported

From Should we MAC-then-encrypt or encrypt-then-MAC?, I understand I should do Encrypt-than-MAC, which the MAC included all the information such as IV and cipher text. After reading Why choose an ...
0
votes
1answer
42 views

Proper authenticated encryption

I am using AES-CBC, authenticating using HMAC-SHA512 and I was wondering whether my thought process and implementation are correct. The message send over the network is: HMAC(64Bytes),IV(16Bytes),...
6
votes
3answers
3k views

Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure?

I am developing a symmetric en-/decryption routine written in c# for a database containing user-specific, sensitive information. I have narrowed down the implementation to 3 different approaches, ...
2
votes
1answer
206 views

Client Puzzles and HMAC

I'm learning about client puzzles for DoS (Denial of Services) Protection, and I came across this question. For each request, the server sends the client a freshly generated random challenge r and ...
1
vote
1answer
46 views

Is it possible to brute force a single smaller variable in $\operatorname{HMAC-SHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$?

Given $c' = \operatorname{HMACSHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$ and the 32-bit integers $a$, $b$, $c$, and $d$ is it feasible to alter $b$ and produce a valid MAC under the unknown key? I ...
1
vote
1answer
113 views

HMAC-SHA1 vs. AES

This might be a very silly question, but I am a total novice in encryption. I don't know where to start searching for an answer to this problem. I am building applications using a proprietary ...
4
votes
1answer
156 views

Yubico's take on U2F key wrapping

I've been reading up on Yubico's implementation of U2F. What I understand so far is that two things are calculated. So upon registration first you calculate a private key by $PrivateKey = HMAC(AppID+...
6
votes
1answer
163 views

Is there any benefit to verifying PKCS#7 padding when using AES CBC and HMAC?

As I'm using HMAC to ensure integrity and authenticity of the ciphertext, is there any additional security benefit to verifying PKCS#7 padding when decrypting using AES CBC? A previous question asked ...
1
vote
0answers
40 views

Is it safe to use a key as message in keyed hashing (HMAC)?

Scenario: User gives password. A "password key" is derived from the password (e.g. by PBKDF2). A random salt is applied. The password key is hashed with a HMAC algorithm (e.g. HMAC-SHA256), with ...
4
votes
2answers
5k views

Why is HMAC-SHA1 still considered secure?

This Q & A http://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
1
vote
1answer
83 views

Understanding WPA2 authentication in details

As far as I know, WPA2 authentication consists of a 4-way handshake. The first message is from the AP, containing the ANounce, a random number generated by the AP, The second message is from the ...
6
votes
1answer
328 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
0
votes
0answers
169 views

Implementing hmac+bcrypt in bash script

I was recently reading Mozilla's Secure Coding guidelines and found their password storage method interesting. They combine an hmac hash of the password with bcrypt which allows for added security ...
3
votes
0answers
44 views

How to make a “zero knowledge” cache/key-value store

I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are: If the cache ever gets compromised it should reveal nothing about its ids or ...
0
votes
1answer
186 views

What happens when cbc+hmac get a replay attack?

If it use AES-CBC and HMAC-SHA256 for message send online, and someone try to replay attack on this message. Can the attack be successful? what will be happen when attacking?
1
vote
2answers
170 views

PHP AES 256 CBC faster than AES 128 CBC? Or am I doing something wrong?

for last couple of days I'm learning a bit about encrypting data in PHP, as I need a good encryption/decryption function for storing user's passwords in DB. I use ...
0
votes
1answer
54 views

Difference between HMAC-SHA1(key, msg) vs SHA1(key + msg) [duplicate]

Is there any practical difference from using HMAC-SHA1(key, msg) vs SHA1(key + msg) as a way to verify the authenticity/...
3
votes
1answer
82 views

Question about HMAC with SHA1

I would like to make sure I understood HMAC. Wikipedia declares it like: $$\operatorname{HMAC}(K,m)=H((K\oplus\text{opad})||H((K\oplus\text{ipad})||m))$$ If I want to use HMAC-SHA1, am I correct to ...
0
votes
2answers
403 views

Why does WPA2-PSK use 4-way handshake instead of 2-way handshake

I don't seem to grasp why is the handshake for PTK in WPA2-PSK 4-way and not 2-way. Isn't it enough to just have these two steps: First party sends Nonce1 to the other party Second party sends to ...
11
votes
2answers
12k views

What is the difference between MAC and HMAC?

In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
7
votes
2answers
843 views

Is there a null HMAC?

I came up with this question while unit testing a function that includes an HMAC. What is the expected behavior of an HMAC with a well-defined key and a set of data with no elements in it? Is there ...
3
votes
1answer
74 views

Deriving a key for HMAC, using PBKDF2

What is the recommended way to derive a key for an HMAC-SHA256, from a passphrase and salt? I'd like to compute an HMAC-SHA256. I have a passphrase, and a message. I note that RFC-7518 (JWA) ...
1
vote
2answers
59 views

NIST HMAC Test vectors

I am searching test vectors of the HMAC-SHA256 primitive to verify the correctness of an implementation. Without hesitation I go on the NIST website to see what they offer. While reading the ...
8
votes
1answer
120 views

Side channel security of HMAC in software

Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256. I've got the ...
1
vote
1answer
431 views

Difference between AES CMAC and AES HMAC?

Can someone elaborate on how 'signing' is done using AES- CMAC and AES-HMAC? HMAC Signing as I understand: Compute the HMAC( Hash the key and the input concatenated in a special way) Verification: ...