(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

3
votes
1answer
181 views

When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
3
votes
1answer
202 views

Why must IV be sent with each packet?

I was reading about Encrypt-then-MAC and everywhere I go it seems people include the IV with the ciphertext generated for each message then MAC that and send all the information concatenated. Why do ...
2
votes
1answer
144 views

How can I validate my implementation of Ansi 9.19?

I implemented an Ansi 9.19 mac generator in java, but now I don't know how to validate its functionality. I couldn't find any sample of a {plain text,key,mac} on the internet, and I want to know if ...
1
vote
0answers
104 views

CBC MAC and DES combined question?

Suppose that we want to develop a MAC scheme which is as secure as Triple-DES CBC-MAC and at the same time as efficient as Single-DES CBC-MAC. We come up with the following idea: Except the last ...
8
votes
1answer
163 views

Can Skein be used as a secure MAC in format H(k || m)?

Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
3
votes
1answer
240 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
3
votes
0answers
81 views

HMAC definition by using only one key

Suppose $H$ is a hash function; why is $H(k||H(k||m))$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $H(k_1 ||H(k_2 ||m))$ . Why don't we use ...
7
votes
1answer
1k views

Use cases for CMAC vs. HMAC?

Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is ...
1
vote
1answer
57 views

MAC security and adversaries with memory

The usual definition of MAC security is (roughly) that there is no "efficient" adversary that has non-negligible advantage in the "MAC game" where the MAC game is as follows: the challenger chooses a ...
1
vote
1answer
70 views

Composing hashes and/or MACs

Suppose I have n hash/MAC functions, of which n-1 are extremely insecure, leaving only one that is in fact cryptographically secure. If I use all of them on a message and the XOR them together the ...
-1
votes
1answer
69 views

How do they implement MAC in TLS?

I recently read questions about "MAC then Encrypt/Encrypt then MAC" which made me curious about how they actually use the algorithm. MAC only calculated once either case (according to what I read). ...
4
votes
1answer
220 views

Why are collision attacks important when talking about MAC schemes?

I'm reading Ferguson, Schneier, and Kouno's Cryptography Engineering, and it has a section on MACs. It discusses different types of MACs, but it seems to claim that to acheive 128-bit level security, ...
3
votes
1answer
194 views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
4
votes
1answer
304 views

For a one-time pad, which MAC method is information-theoretically secure?

In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
0
votes
1answer
188 views

AES CBC MAC splicing attack

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is: given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, ...
2
votes
1answer
247 views

Is this an acceptable implementation of ARC4 encryption for my system?

I am building an open source hardware system that will be used to control things over the internet. The system consists of a Base Station and Modules which use wireless communication at 2.4GHz to ...
1
vote
0answers
69 views

Why don't we use H(m||k) as a MAC? [duplicate]

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work. Is there some other obvious attack?
4
votes
1answer
548 views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
-1
votes
1answer
118 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
1
vote
1answer
96 views

Prove that two MACs with incremendal PRF application are not secure

How do I prove the following MACs are insecure?                                                        1                                                                                   2
1
vote
1answer
184 views

Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be ...
1
vote
1answer
89 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...
11
votes
2answers
383 views

Can I use HMAC-SHA1 in counter mode to make a stream cipher?

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ...
6
votes
2answers
189 views

Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?

I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and ...
1
vote
2answers
93 views

Can a zero knowledge proof (or MAC) be generated from human-typable input?

Edit: My goal is to create a voting scheme that doesn't require a lot of crypto infrastructure to be deployed on the client side. Smartcards, and tokens are impractical for these purposes. I ...
4
votes
1answer
183 views

Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
3
votes
2answers
123 views

What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
2
votes
1answer
212 views

Is this new server API authentication protocol secure?

I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ...
2
votes
1answer
259 views

Why is this MAC based on secure PRF with ordering and randomization insecure?

Is this MAC secure: To authenticate a message $m=m_1||\ldots||m_l$ where $m_i \in \{0,1\}^{n/2}$, choose $r \leftarrow \{0,1\}^n$ at random, compute $$t:=F_k(r)\oplus F_k(\langle 1\rangle || ...
3
votes
1answer
92 views

OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
0
votes
1answer
128 views

Why is appending the key to a mesage and then hashing that insecure if the hash isn't weakly collision resistant? [duplicate]

Suppose I have H(M|K) and that H is not weakly collision resistant. If I have a message mac pair (M,MAC), how is it possible to find another message mac pair (M2,MAC2)? My thinking for this problem is ...
6
votes
2answers
184 views

Why don't we use MACs to store passwords?

These days, the best practice for storing passwords is to use a scheme like scrypt or bcrypt. The goal of these schemes is to make dictionary attack inefficient for an attacker but it also slows down ...
5
votes
1answer
137 views

How would you encrypt-then-MAC when using pen-and-paper and a Caesar cipher?

I'll probably get shot for asking this, but I've got some kids (aged 8-10) in my neighbourhood that I've been showing/teaching the simple pen-and-paper Caesar cipher and they're successfully playing ...
2
votes
1answer
681 views

How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
3
votes
2answers
230 views

Is there a companion algorithm for OTP to ensure integrity and/or authentication?

One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved: Fast generation of independent and identically distributed random variables Perfect key ...
0
votes
3answers
391 views

What block cipher is used for CBC-MAC?

What block cipher is used for CBC-MAC? DES, AES, 3DES? Or it doesn't matter?
1
vote
3answers
207 views

Does MAC provide origin authentication? Why not just use symmetric encryption?

Let's assume Bob and Alice has a secret key for MAC. If MAC is constructed by the key and the message, that means that both Alice and Bob can construct the exact same message and MAC. So, Bob can ...
5
votes
1answer
185 views

Proof that MACing a hash of the message is also a secure MAC

I found a theorem that says: Let $MAC = (S,V)$ be a MAC for short messages over $(K,M,T)$. Let $H: M^{big} → M$. Define $MAC^{big} = (S^{big},V^{big})$ over $(K,M^{big},T)$ as: $S^{big}(k,m) = ...
3
votes
2answers
264 views

Does encrypting a hash of the message yield a secure MAC?

Is $mac = enc(hash(x))$ a secure MAC for hash = SHA256 and enc AES in CBC mode or ECB mode. Normally AES-CBC is malleable. But in this case I use a hash function for the one-way property. For ...
4
votes
2answers
488 views

What is the definition of “security beyond the birthday paradox”?

I'm reading a paper about MACs and I would like to be sure about the meaning of a security beyond the birthday paradox. Is there a definition?
2
votes
1answer
127 views

Is it possible to find a preimage for a reduced size hash?

Given a message $M$ and a 256 bit key $K$, perform HMAC($K$, $M$) with a 256 bit hash function resulting in: $a$ = ...
5
votes
1answer
236 views

HMAC construction based on the combination of two hash functions

I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of ...
2
votes
1answer
92 views

Is it possible to generate a message using the mac and the key?

Say that you have the Key and the MAC value that was generated from the Key using CBC. Is it possible to generate a message with just the mac and the key? If so, how would you do it?
3
votes
1answer
72 views

Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every ...
7
votes
2answers
255 views

Why have hashes when you have MACs?

It would seem to a naive eye that if you have a MAC, you have a hash function: use a key that all the parties know (such as all-bits-zero). A potential application would be a resource-constrained ...
1
vote
2answers
230 views

What security flaw exists in MAC authentication scenario?

What security flaw exists (if any) in the solution of this non-encrypted authentication scenario? An unencrypted message passes one-way from computer A to B. Its transmission is viewable by the ...
6
votes
1answer
566 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
3
votes
1answer
246 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
5
votes
1answer
245 views

How does NaCL Poly1305 implementation do modular multiplication?

The NaCL ref implementation of Poly1305 performs modular multiplication to calculate a polynomial $\mod 2^{130} - 5$ using the following modular multiplication ...
10
votes
9answers
464 views

Physical analogue for MACs

What would be a good analogue with which to describe Message Authentication Codes to a person who has little to no understanding of cryptography? For instance, a vault is a reasonable analogue for ...