(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

4
votes
1answer
124 views

The difference between MAC algorithms and what to use

I've been looking into message authentication codes and found several ways to create integrity for a message. I know of the following algorithms: HMAC, this can use any cryptograhpic hash function ...
0
votes
0answers
69 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...
2
votes
1answer
100 views

New to cryptology, studying Message Authentication Codes

I understand the basic operational theory behind MAC, but I'm getting tripped up on some of the finer details. Also the differences between MAC, HMAC and MIC are getting lost on me, including the ...
2
votes
1answer
53 views

Is it secure to transmit a short plaintext with its MAC?

I have a short (32-bit) message that needs to be authenticated. Due to the constraints of my platform, I would like to use Speck32/64 (32-bit block, 64-bit key) with a Matyas-Meyer-Oseas one-way ...
0
votes
1answer
82 views

MAC in SSH packet encryption, benefits to not including it?

What are the benefits to not including MAC in a SSH packet encryption? I understand what the MAC is there for, but if it was not included would there be an advantage? Is the MAC somewhat redundant ...
0
votes
0answers
40 views

Separate keys for encryption and MAC? [duplicate]

I use HMAC(ciphertext)+ciphertext for authenticated encryption. The same key is used for both MAC and encryption. Is that right? Is using separate keys for MAC and encryption necessary or any good? ...
-3
votes
1answer
116 views

Attacking multi block MAC constructions

For variable-length messages, there are three different ways to generate the tags. $Tag = MAC_k(\Sigma_i m_i)$. $t_i = MAC_k(m_i)$ and $Tag = (t_1, ..., t_l)$. $t_i = MAC_k(i||m_i)$ ...
0
votes
1answer
36 views

Using Permutation polynomial to compute a MAC

Is the following MAC secure? For a block $y_i$ in a file, we defined a MAC as follows: $Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$. Where $p$ is a prime number, $g \in \mathbb{G}$,$PRF(k,i)$ is ...
1
vote
1answer
93 views

Simple message authentication code

I used to figure that message authentication codes function like digital signatures: a hash of a message is calculated and then encrypted with a secret key. To verify the authenticity of a message, ...
1
vote
0answers
59 views

chacha20-poly1305 padding and length encoding

The AEAD construction for chacha20-poly1305 described in the IETF proposal [1] encodes message lengths into the text that is to be hashed. The newer proposal [2] goes further and pads associated data ...
1
vote
0answers
66 views

Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
0
votes
1answer
66 views

Nonces being used in SSL and MAC to prevent replay attacks

I'm a bit confused in the way nonces are used in these processes to prevent replay attacks. Heres How I think it works during SSL: Nonces are exchanged during stage one of the handshake protocol. ...
0
votes
1answer
35 views

Integrity protection in wireless sensor networks [closed]

I have done a lab about wireless sensor nodes and got in touch with encryption for the very first time. There are some questions on my sheet, especially on integrity protection (the attacker wants to ...
0
votes
1answer
110 views

CBC with a fixed or random IV

I have two probably quite naive questions: 1) Why, exactly, is it so bad to have a fixed (or predictable) IV in CBC mode? An example would be great! 2) Given 1), why is a random IV better? And if ...
1
vote
1answer
96 views

Why are there no MACs inspired by block cipher modes other than CBC and CFB?

I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter. Why are CBC ...
0
votes
1answer
107 views

Size of a MAC for a quickly checked message?

Let suppose that we have to check a message that was written one second ago. The message is discarded immediately after having being checked. What "minimal" size for such a MAC is secure ? Thank you. ...
0
votes
2answers
45 views

How to use HMAC for authenticating multiple messages

The standard HMAC function, $H(K, m)$, authenticates a single message $m$. Instead, I'd like to authenticate 2 messages, like this: $$H'(K, m_1, m_2)$$ The simplest solution, $H(K, m_1||m_2)$, ...
0
votes
1answer
54 views

Specific example of a MAC in TLS?

This seems like quite a dumb question, but I really don't know if I'm finding a answer anywhere. I understand that if i access a website that is secured with TLS, we exchange ciphersuites and so on, ...
-1
votes
1answer
69 views

HMAC ipad and opad choice

It is written in the HMAC paper that the $ipad=0x36$ and $opad=0x5c$ were chosen such that it maximize the Hamming-Distance of the part of the key used in the inner and outer part of the HMAC process. ...
9
votes
2answers
265 views

Definition of “pepper” in hash functions

I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, a ...
3
votes
2answers
153 views

Can a secret message be securely transmitted within a MAC tag?

A sender wants to transmit an ultra secret code $M$ which could be either 'go', 'stop' or 'wait'. This could be any selection of code words really and adopted for any use such as transmitting short ...
9
votes
2answers
154 views

Why is Poly1305 popular given its 'sudden death' properties?

ECDSA has the undesirable property that if a key pair reuses a nonce in a signing operation, the cryptosystem experiences catastrophic failure in the form of private key leakage. I've heard this ...
1
vote
1answer
99 views

How can CBC-MAC be secure when message length is fixed?

I was doing some self-initiated knowledge gathering about digests, signatures and hmacs and I ran across the fact that you can use CBC as a MAC, but if the message size is not fixed; then it is not ...
3
votes
2answers
107 views

Strange MAC algorithm

I'm working with a payment provider which uses the following algorithm for signing messages: The merchant is securely given a secret key k, known to them and the ...
2
votes
0answers
53 views

Using same key for encryption and ECBC-MAC k2

ECBC-MAC: $E_{k_2}(CBC-MAC_{k_1}(m))$ If we use same key for encryption (CTR or CFB) and k2 (end tag encryption) in ECBC-MAC in encrypt-than-MAC sheme, is it secure?
2
votes
1answer
62 views

Is XCBC where k2 and k3 might be the identical, secure?

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding. ...
2
votes
2answers
114 views

Is it safe to salt a MAC?

Say that I define a scheme where the salt is public and is MAC-ed with the message: $k = KDF(password, salt)$ $tag = MAC_k(salt || message)$ Is it safe to salt the MAC this way? Assume that the salt ...
0
votes
1answer
62 views

Efficiently show/prove knowledge of third party secret without leaking information

Say Alice publishes (i.e. all parties in the universe) a key or certificate $x$ and sends a secret $s$ to Bob. Bob then publishes some data $d$ (his identity or a message or smt.) and an ...
4
votes
2answers
201 views

Secure way to derive separate encryption and MAC keys from a single master key?

I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme. I was considering the following construction to derive the two ...
1
vote
0answers
35 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
1
vote
1answer
78 views

ECIES: Purpose of MAC?

Assumptions: $A$ wants to communicate with $B$ $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$ $A$ knows the address of someone who pretends to be $B$ $A$ wants ...
3
votes
1answer
381 views

What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

The DES retail MAC, also known as ISO 9797-1 mode 3 with DES, computes the MAC of a block of data using a 16-byte (112 bit) key. It can be seen as CBC-MAC using simple DES with the first half of the ...
3
votes
2answers
354 views

AES-ECB as an authentication mechanism

ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication? Assume A wants to transmit an ...
0
votes
1answer
302 views

How is HMAC hashed message decrypted on the receiver side

We know that MAC algorithm and key are used in both sender and receiver side to get the matching MAC tages to prove that the data is authentic. Now in HMAC we know that, it makes use of crytographic ...
1
vote
1answer
48 views

Is MAC algorithm same at both sender and receiver end

The MAC algortihm which is used along with a secret key to generate a MAC tag on the sender end ,is it same at the receiver end also who again uses a MAC algorithm to generate a tag? If yes, then how ...
2
votes
0answers
117 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
2
votes
1answer
81 views

Parallel variant of Carter-Wegman MAC with incremental property

Is there any variant of the Carter-Wegman MAC algorithm that is fast, parallel and has the property of incremental crypto?
4
votes
2answers
210 views

Block-cipher based vs Hash based MAC

When it comes to MAC algorithms one can have many choices. CBC-MAC, CMAC, PMAC etc are some MAC algorithms that rely on block ciphers (ex AES) to generate a MAC. On the other hand HMAC is very popular ...
3
votes
2answers
274 views

Security issues of a MAC-then-Encrypt-then-MAC approach?

Encrypt-then-MAC does provide ciphertext integrity, but no plaintext integrity. With MAC-then-Encrypt it’s the other way around: Plaintext integrity but no ciphertext integrity. What comes to mind is ...
0
votes
1answer
134 views

Is MAC-then-encrypt with stream ciphers secure?

While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is ...
2
votes
2answers
214 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
1
vote
1answer
176 views

MAC using a modified CBC mode of operation

I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV). Source: an old course on Network Security Are there some obvious attacks I can't see?
4
votes
1answer
402 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
3
votes
1answer
331 views

Using GMAC for Authentication without encrypting the message

I am pretty new to cryptography and have a sample of GCM mode of operation for AES. PFB the code ...
2
votes
1answer
94 views

Is a keyed PRF a MAC?

I remember I read that a MAC can be considered as a PRF. Can a variable-length input keyed-PRF be considered as a MAC?
5
votes
1answer
242 views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
2
votes
2answers
233 views

Choice of MAC and handling it correctly

I have recently learned that Encrypt-then-MAC is recommended when using symmetric encryption. I have two closely related questions related to that, which is why I am posting them as one: Looking ...
14
votes
4answers
2k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
5
votes
2answers
194 views

Does data authenticity always, implicitly, provide data integrity?

Does a scheme which provides data authenticity (e.g. HMAC or RSA signature) always implicitly provide integrity? It seems, to me at least, that it must by necessity. However, I have seen ...
2
votes
1answer
221 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...