(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

1
vote
1answer
167 views

Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be ...
1
vote
1answer
84 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...
11
votes
2answers
307 views

Can I use HMAC-SHA1 in counter mode to make a stream cipher?

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ...
6
votes
2answers
162 views

Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?

I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and ...
1
vote
2answers
90 views

Can a zero knowledge proof (or MAC) be generated from human-typable input?

Edit: My goal is to create a voting scheme that doesn't require a lot of crypto infrastructure to be deployed on the client side. Smartcards, and tokens are impractical for these purposes. I ...
4
votes
1answer
179 views

Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
3
votes
2answers
110 views

What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
2
votes
1answer
200 views

Is this new server API authentication protocol secure?

I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ...