(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

2
votes
1answer
31 views

Is this hash function almost XOR universal?

Consider this hash function: The key $K$ is $2^n$ bits. The message $M$ is divided into $2^n$ bit blocks. Arithmetic is performed modulo $2^{n+1}$. The hash is defined by: $ H_0 = 1 $. $H_{i+1} = ...
3
votes
1answer
19 views

Encrypt-then-MAC when encrypting data in multiple blocks

Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ? For example, the plaintext is 530 bytes long. We read ...
2
votes
2answers
529 views

Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
1
vote
1answer
41 views

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures ...
1
vote
0answers
57 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
1
vote
1answer
32 views

Why does Carter-Wegman MAC have 2n-bit output?

The Coursera course on Cryptography 1 has a section about Carter-Wegman MAC. Here is the image of slide: Now my question is both $F$ and $S$ output $n$-bit strings. We XOR two $n$-bit strings and we ...
2
votes
1answer
57 views

SipHash's (non-)collision resistance

I'm very new to cryptography, and I need help understanding the security claims made in Aumasson and Bernstein's paper on the SipHash. In particular, I'm trying to understand the following statement ...
4
votes
1answer
50 views

Prove that the following MAC is insecure

I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved: Gen generates a uniform $k \in \{0, 1\}^n$. To ...
4
votes
2answers
64 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
0
votes
0answers
26 views

MAC is constructed by hashing and then encrypting

Suppose the MAC is constructed by hashing and then encrypting, that is $MAC(m, k2)=E_{k2}(H(m))$ where H is a public hash function. There can be several alternatives in how the transmitted message is ...
3
votes
2answers
545 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
1
vote
1answer
237 views

Do I need to use a MAC with asymmetric encryption?

The internet has drilled into me that when I delivery any symmetrically encrypted data, I should also deliver a MAC to authenticate it before any decryption occurs. Do I also need to do this if I use ...
0
votes
3answers
112 views

About MAC and HMAC

I'm studying mechanisms of integrity and authentication in symmetric encryption scenarios. I want to propose some examples to see whether I got the point here: Let $m$ be the message, $c$ the ...
4
votes
0answers
54 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
1answer
89 views

Authenticated encryption with Signatures

I've given a CPA secure private key encryption scheme (wich gets to a CCA secure scheme or better to an authenticated encryption scheme, when i combine it with a given MAC) and a unforgeable public ...
0
votes
1answer
28 views

A simple keyed message authentication code using XOR

Suppose I have a key that is at least 32 characters in length and provides at least 128-bits of entropy. If I picked from the character set of [a-hjkmnp-z2-9-], ...
0
votes
1answer
25 views

Uniqueness of checksums using DES-MAC encryption?

I'm in an Intro to Computer Security class, and one concept I'm having trouble understanding is how two different files could produce the same checksum. How would you produce the same checksum given ...
1
vote
0answers
19 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
1
vote
2answers
93 views

Difference between MAC and Authenticated Encryption?

I am currently studying authenticated encryption and I was wondering if there was a difference between using a MAC and authenticated encryption. It seemed like authenticated encryption schemes use ...
0
votes
0answers
26 views

Using Counters instead of MAC in CBC mode

I am wondering what are the implications of using a session counter appended to the end of a plaintext and then use a cipher in CBC mode to encrypt it vs. adding a HMAC or some form of keyed MAC to ...
1
vote
1answer
56 views

Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?

I am preparing for an exam and trying to solve the following question I found on the internet: Let $F_k$ be a pseudorandom function. Show that the following MAC for messages of length $2n$ is ...
1
vote
0answers
70 views

Confidentiality then Integrity with different keys

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
0
votes
2answers
42 views

SIV - Synthetic IV - S2V Construction? Benefits over a MAC or Hash?

Looking at the SIV construction in rfc-5297 - https://tools.ietf.org/html/rfc5297 With regards to the generation of the SIV, using S2V construction, I am struggling to find the benefits of the chosen ...
1
vote
1answer
68 views

Understanding WPA2 authentication in details

As far as I know, WPA2 authentication consists of a 4-way handshake. The first message is from the AP, containing the ANounce, a random number generated by the AP, The second message is from the ...
0
votes
1answer
39 views

How would the opponent defraud this secure communication?

I am new in the cryptography and the information security problems, I try to understand things as much as I can and I know it's really complicated in the beginning. Considering the communication ...
0
votes
2answers
78 views

Is a PRF applied to a secure MAC also a secure MAC?

Suppose I apply a PRF to a secure MAC. Do I still have a secure MAC?
0
votes
1answer
56 views

Creating a message authentication scheme

I have such situation. I have a device like dongle. But it has certain limitations. For example, it can only have implemented encryption and decryption functionality. The availability of ciphers ...
1
vote
0answers
33 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
1
vote
0answers
42 views

Can an attacker recover the key if a Poly1305 collision is known?

Suppose that messages $m_1$ and $m_2 \neq m_1$, both known to the attacker, are both MAC'd through Poly1305 with the same key. By chance, these two messages hash to the same value. The attacker ...
0
votes
1answer
42 views

Difference between single-pass and two-pass MACs

I am having trouble understanding where the count of "passes" come in. What constitutes a pass in the context of message authentication codes? How are single-pass MACs achieved?
5
votes
2answers
99 views

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal ...
1
vote
1answer
95 views

Why does a fixed key not make MACs like CBC-MAC or GMAC into secure hash functions? [duplicate]

Why does setting the secret key to a fixed, public value not make MACs like CBC-MAC or EMAC into secure unkeyed cryptographic hash functions? In other words, why is the resulting hash function not ...
0
votes
0answers
36 views

Poly1305 vs VMAC: is VMAC much better for long messages?

VMAC seems to me much more secure than Poly1305 on long messages (the security of the latter decreases linearly with increasing message length). Is this of practical relevance?
1
vote
1answer
53 views

Find the minimum Adversary's Advantage

I am wondering how to solve the problem below: Suppose we have a $MAC$ scheme $I=(S,V)$. There is another algorithm that can find a pair of texts $(m0,m1)$, with $m0≠m1$ such that $S(k,m0)=S(k,m1)$ ...
1
vote
1answer
32 views

Key Exchange MAC encryption order of events? Problem

I want to write the sequence of events of how a MAC encryption works for documentation at work. For this purpose I have a document (given by my boss to me) in German and I am trying to translate it ...
1
vote
2answers
98 views

MAC algorithm difficulties

Can anyone explain to me why this is a bad idea? I cannot see anything wrong with it except that key K should be different for MAC and AES. MAC algorithm consists of letting the MAC of message M ...
8
votes
1answer
113 views

Side channel security of HMAC in software

Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256. I've got the ...
3
votes
1answer
62 views

Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
5
votes
1answer
89 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
2
votes
1answer
74 views

Preserving Confidentiality and Integrity in a Public channel

Let's say I've got two people that are trying to talk in a public channel $A$ and $B$ and they want to preserve their confidentiality and integrity. Which cryptographic algorithm would they want to ...
3
votes
0answers
64 views

Why reveal MAC-keys after using them?

As far as my understanding goes MACs are used to determine whether the received message comes from a source that has access to a MAC-key which is known by both parties. Some crypto protocols reveal ...
6
votes
3answers
602 views

What is the advantage of digital signatures over message authentication codes?

Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ...
4
votes
1answer
64 views

What is the difference between MACTripleDES and TripleDES?

I was asked to encrypt/decrypt a string using MACTripleDES. Is there any difference between MACTripleDES and TripleDES? If, where exactly is the difference between both?
3
votes
1answer
103 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
2
votes
1answer
37 views

Should I authenticate memory data which was loaded from authenticated disk file?

Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to ...
2
votes
1answer
80 views

Is this MAC scheme secure?

Say we have a computationally secure Message Authentication Code scheme (Gen, Tag, Ver). Let $Tag'_k(m):=$ first half bits of $Tag_k(m)$. Let's assume the range of tags is $n$bits. Is (Gen, Tag', ...
3
votes
2answers
62 views

Is it OK to use a secret IV as key when creating keyed MD5 checksum for fixed-size data?

Is it OK to use a secret IV as key when creating keyed MD5 checksum for fixed-size data? Because data size is known, attacker cannot append anything. And I think it's hard to raise chosen-plaintext ...
4
votes
1answer
68 views

Is it wise to use HOTP (raw bytes) as a key for HMAC?

Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared ...
0
votes
0answers
55 views

Detecting Software Changes - Verifying untampered code

This question assumes an environment devoid of any internet connections, the software in questions operates in a non-connected environment on a single machine. I have a piece of software that may be ...
0
votes
0answers
40 views

Non CPA on custom MAC

While preparing for a crypto exam there is a task we don't really understand: task Let $E_K$ be a permutation $\{0,1\}^b \rightarrow \{0,1\}^b$ defined by a blockcipher with the key $K$. Let $M = ...