(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

5
votes
1answer
167 views

Fast 128-bit MAC with second preimage resistance?

I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
7
votes
1answer
253 views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...
3
votes
1answer
64 views

Are deployed MACs IND-CPA?

There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk ...
3
votes
1answer
838 views

Authentication using AES

I need to implement an authentication mechanism in an embedded environment which does not support floating point operations but has an AES accelerator module which allows for encyption/decryption ...
5
votes
1answer
145 views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
3
votes
2answers
98 views

Does AES(x || x) provide secure message authentication when message fits in a single block?

Suppose I have x = <64 bits of data>. I build a 128 bit block $P = x || x$, and transmit a message $M = AES(K, P)$. The receiver has the same $K$. The ...
5
votes
1answer
620 views

Ciphertext and tag size and IV transmission with AES in GCM mode

I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
3
votes
1answer
83 views

Can I reduce the MAC size in TLS?

The MAC size is reduced to 80 bits in truncated_hmac extension , which says "forging of MAC values cannot be done off-line: in TLS, a single failed MAC guess will cause the immediate termination of ...
4
votes
1answer
112 views

Parallel authentication of encrypted data. What AE type to choose?

I've got a system with a slow data transfer channel. Transferring a message through several channels does increase the transfer speed significatnly. AES-CBC+HMAC is good except that verifying the MAC ...
1
vote
1answer
123 views

How is wpa2 authentication structured

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to ...
1
vote
2answers
87 views

Concerns about use of MAC in my specification

Here is the pseudocode for a routine I am designing: ...
1
vote
1answer
61 views

Why does UMAC encrypt the output of universal hash function?

UMAC uses a key to choose a random hash function from a family of universal hash functions. The value of the hash function is always encrypted using yet another key, and the resulting ciphertext ...
2
votes
3answers
134 views

Why not put MAC in fixed position and cover padding for MAC-then-encrypt?

The biggest problem with using MtE with a mode where it's known to be secure (CBC) is with the padding, where you can't retrieve the authentication until you know where it is by looking at the padding ...
0
votes
1answer
76 views

Authenticating small packets

I intend to authenticate small packets of data, between 16 and 256 bytes each. For some of them encryption will also be required. This will be used on small micro controllers, with RAM sizes ranging ...
1
vote
1answer
81 views

Differences between HMAC and HKDF in a specific case

I want to use a key derivation function to derive a key to another one. I think HKDF is the easiest solution in my case. The following picture gives a clear definition of it : ...
1
vote
0answers
45 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute ...