(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

0
votes
0answers
56 views

Explanation of cryptographic terminology for newbies [closed]

I feel like I'm making a mountain out of a molehill here, but I have (what should be) a relatively simple project, but the terminology used all over the Internet is either too simple or too difficult ...
11
votes
2answers
960 views

Can any MAC be used as a KDF?

First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
-1
votes
0answers
23 views

Counter-Mode Message Authentication Code [duplicate]

Excuse my naivety,I don't know much about crypto. But I've been wondering, couldn't counter-mode be used for MAC just like CBC in CBC-MAC, assuming nonce for the counter is not repeated? Am I missing ...
4
votes
0answers
41 views

Do we still need HMAC now that SHA3 is here? [duplicate]

In Another look at HMAC from Koblitz and Menezes, they state that HMAC came along because doing h(secret || message) was vulnerable to length extension attacks. But as far as I know, these kind of ...
1
vote
0answers
47 views

Safe MAC proof check

Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$. Is the following $MAC$ safe? Show your proof. $Mac'(k,m) = Mac(k, m)$ $Vrfy'(k,m,t) = \{Vrfy(...
1
vote
1answer
75 views

Security of a MAC

Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$. Is the following $MAC$ safe? Show your proof. $Mac'(k,m) = Mac(k, m ⊕ m)$ $Vrfy'(k,m,t) = ...
2
votes
1answer
38 views

Is this hash function almost XOR universal?

Consider this hash function: The key $K$ is $2^n$ bits. The message $M$ is divided into $2^n$ bit blocks. Arithmetic is performed modulo $2^{n+1}$. The hash is defined by: $ H_0 = 1 $. $H_{i+1} = ...
3
votes
1answer
26 views

Encrypt-then-MAC when encrypting data in multiple blocks

Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ? For example, the plaintext is 530 bytes long. We read ...
2
votes
2answers
547 views

Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
2
votes
1answer
55 views

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures Questions: why ...
1
vote
0answers
61 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
1
vote
1answer
32 views

Why does Carter-Wegman MAC have 2n-bit output?

The Coursera course on Cryptography 1 has a section about Carter-Wegman MAC. Here is the image of slide: Now my question is both $F$ and $S$ output $n$-bit strings. We XOR two $n$-bit strings and we ...
2
votes
1answer
62 views

SipHash's (non-)collision resistance

I'm very new to cryptography, and I need help understanding the security claims made in Aumasson and Bernstein's paper on the SipHash. In particular, I'm trying to understand the following statement ...
4
votes
1answer
55 views

Prove that the following MAC is insecure

I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved: Gen generates a uniform $k \in \{0, 1\}^n$. To ...
4
votes
2answers
73 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
0
votes
0answers
27 views

MAC is constructed by hashing and then encrypting

Suppose the MAC is constructed by hashing and then encrypting, that is $MAC(m, k2)=E_{k2}(H(m))$ where H is a public hash function. There can be several alternatives in how the transmitted message is ...
3
votes
2answers
549 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
1
vote
1answer
255 views

Do I need to use a MAC with asymmetric encryption?

The internet has drilled into me that when I delivery any symmetrically encrypted data, I should also deliver a MAC to authenticate it before any decryption occurs. Do I also need to do this if I use ...
0
votes
3answers
116 views

About MAC and HMAC

I'm studying mechanisms of integrity and authentication in symmetric encryption scenarios. I want to propose some examples to see whether I got the point here: Let $m$ be the message, $c$ the ...
4
votes
0answers
54 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
1answer
89 views

Authenticated encryption with Signatures

I've given a CPA secure private key encryption scheme (wich gets to a CCA secure scheme or better to an authenticated encryption scheme, when i combine it with a given MAC) and a unforgeable public ...
0
votes
1answer
35 views

A simple keyed message authentication code using XOR

Suppose I have a key that is at least 32 characters in length and provides at least 128-bits of entropy. If I picked from the character set of [a-hjkmnp-z2-9-], ...
0
votes
1answer
26 views

Uniqueness of checksums using DES-MAC encryption?

I'm in an Intro to Computer Security class, and one concept I'm having trouble understanding is how two different files could produce the same checksum. How would you produce the same checksum given ...
1
vote
0answers
20 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
1
vote
2answers
96 views

Difference between MAC and Authenticated Encryption?

I am currently studying authenticated encryption and I was wondering if there was a difference between using a MAC and authenticated encryption. It seemed like authenticated encryption schemes use ...
0
votes
0answers
26 views

Using Counters instead of MAC in CBC mode

I am wondering what are the implications of using a session counter appended to the end of a plaintext and then use a cipher in CBC mode to encrypt it vs. adding a HMAC or some form of keyed MAC to ...
2
votes
1answer
60 views

Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?

I am preparing for an exam and trying to solve the following question I found on the internet: Let $F_k$ be a pseudorandom function. Show that the following MAC for messages of length $2n$ is ...
1
vote
0answers
73 views

Confidentiality then Integrity with different keys

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
1
vote
1answer
53 views

SIV - Synthetic IV - S2V Construction? Benefits over a MAC or Hash?

Looking at the SIV construction in rfc-5297 - https://tools.ietf.org/html/rfc5297 With regards to the generation of the SIV, using S2V construction, I am struggling to find the benefits of the chosen ...
1
vote
1answer
85 views

Understanding WPA2 authentication in details

As far as I know, WPA2 authentication consists of a 4-way handshake. The first message is from the AP, containing the ANounce, a random number generated by the AP, The second message is from the ...
0
votes
1answer
39 views

How would the opponent defraud this secure communication?

I am new in the cryptography and the information security problems, I try to understand things as much as I can and I know it's really complicated in the beginning. Considering the communication ...
1
vote
2answers
82 views

Is a PRF applied to a secure MAC also a secure MAC?

Suppose I apply a PRF to a secure MAC. Do I still have a secure MAC?
0
votes
1answer
58 views

Creating a message authentication scheme

I have such situation. I have a device like dongle. But it has certain limitations. For example, it can only have implemented encryption and decryption functionality. The availability of ciphers ...
2
votes
0answers
35 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
1
vote
0answers
42 views

Can an attacker recover the key if a Poly1305 collision is known?

Suppose that messages $m_1$ and $m_2 \neq m_1$, both known to the attacker, are both MAC'd through Poly1305 with the same key. By chance, these two messages hash to the same value. The attacker ...
1
vote
1answer
47 views

Difference between single-pass and two-pass MACs

I am having trouble understanding where the count of "passes" come in. What constitutes a pass in the context of message authentication codes? How are single-pass MACs achieved?
5
votes
2answers
102 views

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal ...
1
vote
1answer
99 views

Why does a fixed key not make MACs like CBC-MAC or GMAC into secure hash functions? [duplicate]

Why does setting the secret key to a fixed, public value not make MACs like CBC-MAC or EMAC into secure unkeyed cryptographic hash functions? In other words, why is the resulting hash function not ...
0
votes
0answers
36 views

Poly1305 vs VMAC: is VMAC much better for long messages?

VMAC seems to me much more secure than Poly1305 on long messages (the security of the latter decreases linearly with increasing message length). Is this of practical relevance?
1
vote
1answer
56 views

Find the minimum Adversary's Advantage

I am wondering how to solve the problem below: Suppose we have a $MAC$ scheme $I=(S,V)$. There is another algorithm that can find a pair of texts $(m0,m1)$, with $m0≠m1$ such that $S(k,m0)=S(k,m1)$ ...
1
vote
1answer
41 views

Key Exchange MAC encryption order of events? Problem

I want to write the sequence of events of how a MAC encryption works for documentation at work. For this purpose I have a document (given by my boss to me) in German and I am trying to translate it ...
1
vote
2answers
100 views

MAC algorithm difficulties

Can anyone explain to me why this is a bad idea? I cannot see anything wrong with it except that key K should be different for MAC and AES. MAC algorithm consists of letting the MAC of message M (...
8
votes
1answer
120 views

Side channel security of HMAC in software

Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256. I've got the ...
3
votes
1answer
64 views

Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
5
votes
1answer
91 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
2
votes
1answer
78 views

Preserving Confidentiality and Integrity in a Public channel

Let's say I've got two people that are trying to talk in a public channel $A$ and $B$ and they want to preserve their confidentiality and integrity. Which cryptographic algorithm would they want to ...
3
votes
0answers
65 views

Why reveal MAC-keys after using them?

As far as my understanding goes MACs are used to determine whether the received message comes from a source that has access to a MAC-key which is known by both parties. Some crypto protocols reveal ...
6
votes
3answers
635 views

What is the advantage of digital signatures over message authentication codes?

Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ...
4
votes
1answer
75 views

What is the difference between MACTripleDES and TripleDES?

I was asked to encrypt/decrypt a string using MACTripleDES. Is there any difference between MACTripleDES and TripleDES? If, where exactly is the difference between both?
3
votes
1answer
105 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...