(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

5
votes
1answer
167 views

Fast 128-bit MAC with second preimage resistance?

I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
7
votes
1answer
253 views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...
3
votes
1answer
65 views

Are deployed MACs IND-CPA?

There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk ...
3
votes
1answer
844 views

Authentication using AES

I need to implement an authentication mechanism in an embedded environment which does not support floating point operations but has an AES accelerator module which allows for encyption/decryption ...
5
votes
1answer
147 views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
3
votes
2answers
98 views

Does AES(x || x) provide secure message authentication when message fits in a single block?

Suppose I have x = <64 bits of data>. I build a 128 bit block $P = x || x$, and transmit a message $M = AES(K, P)$. The receiver has the same $K$. The ...
5
votes
1answer
648 views

Ciphertext and tag size and IV transmission with AES in GCM mode

I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
3
votes
1answer
84 views

Can I reduce the MAC size in TLS?

The MAC size is reduced to 80 bits in truncated_hmac extension , which says "forging of MAC values cannot be done off-line: in TLS, a single failed MAC guess will cause the immediate termination of ...
4
votes
1answer
112 views

Parallel authentication of encrypted data. What AE type to choose?

I've got a system with a slow data transfer channel. Transferring a message through several channels does increase the transfer speed significatnly. AES-CBC+HMAC is good except that verifying the MAC ...
1
vote
1answer
124 views

How is wpa2 authentication structured

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to ...
1
vote
2answers
87 views

Concerns about use of MAC in my specification

Here is the pseudocode for a routine I am designing: ...
1
vote
1answer
61 views

Why does UMAC encrypt the output of universal hash function?

UMAC uses a key to choose a random hash function from a family of universal hash functions. The value of the hash function is always encrypted using yet another key, and the resulting ciphertext ...
2
votes
3answers
135 views

Why not put MAC in fixed position and cover padding for MAC-then-encrypt?

The biggest problem with using MtE with a mode where it's known to be secure (CBC) is with the padding, where you can't retrieve the authentication until you know where it is by looking at the padding ...