(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

5
votes
1answer
156 views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
5
votes
2answers
360 views

Secure way to derive separate encryption and MAC keys from a single master key?

I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme. I was considering the following construction to derive the two ...
5
votes
1answer
630 views

For a one-time pad, which MAC method is information-theoretically secure?

In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
5
votes
2answers
102 views

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal ...
5
votes
1answer
171 views

How would you encrypt-then-MAC when using pen-and-paper and a Caesar cipher?

I'll probably get shot for asking this, but I've got some kids (aged 8-10) in my neighbourhood that I've been showing/teaching the simple pen-and-paper Caesar cipher and they're successfully playing ...
5
votes
1answer
872 views

Has GMAC mode a future outside GCM?

Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
5
votes
2answers
450 views

Cost of attacking Mobile OTP with a fake server

You want to obtain a 74-bit secret $K$. There is an oracle that will provide you with the following value for several values of $T$: $$(\mathrm{MD5}(T_{\mathrm{dec}}||K_{\mathrm{hex}}))_{\mathrm{hex}}...
5
votes
1answer
91 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
5
votes
1answer
170 views

Fast 128-bit MAC with second preimage resistance?

I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
5
votes
2answers
1k views

How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
5
votes
1answer
271 views

HMAC construction based on the combination of two hash functions

I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of $\operatorname{HMAC}(...
4
votes
2answers
234 views

Is SHA1 secure with such many inputs Z that Z = constant secret X + variable public Y?

Let me ask whether SHA1 is designed to be secure for the following case. You compute each SHA1 of many strings,for example 1 million, where each string is a concatenation of X+Y , where X is secret ...
4
votes
2answers
73 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
4
votes
1answer
371 views

How safe is it to derive MAC key from a hashed password?

Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
4
votes
1answer
509 views

Why are collision attacks important when talking about MAC schemes?

I'm reading Ferguson, Schneier, and Kouno's Cryptography Engineering, and it has a section on MACs. It discusses different types of MACs, but it seems to claim that to acheive 128-bit level security, ...
4
votes
1answer
74 views

What is the difference between MACTripleDES and TripleDES?

I was asked to encrypt/decrypt a string using MACTripleDES. Is there any difference between MACTripleDES and TripleDES? If, where exactly is the difference between both?
4
votes
2answers
183 views

Can a secret message be securely transmitted within a MAC tag?

A sender wants to transmit an ultra secret code $M$ which could be either 'go', 'stop' or 'wait'. This could be any selection of code words really and adopted for any use such as transmitting short ...
4
votes
1answer
1k views

What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

The DES retail MAC, also known as ISO 9797-1 mode 3 with DES, computes the MAC of a block of data using a 16-byte (112 bit) key. It can be seen as CBC-MAC using simple DES with the first half of the ...
4
votes
1answer
696 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
4
votes
1answer
195 views

Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say $s=32$;...
4
votes
2answers
738 views

What is the definition of “security beyond the birthday paradox”?

I'm reading a paper about MACs and I would like to be sure about the meaning of a security beyond the birthday paradox. Is there a definition?
4
votes
1answer
581 views

Using a derived key for CMAC

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication: Two keys are derived from the master key k (16 byte): ...
4
votes
1answer
54 views

Prove that the following MAC is insecure

I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved: Gen generates a uniform $k \in \{0, 1\}^n$. To ...
4
votes
1answer
248 views

How to design a practical and secure MAC scheme?

I am sorry, but I need to introduce some concepts which are not directly related to cryptography to make myself clear, I hope I won't stun you with this ... (I'd rather explain it here than redirect ...
4
votes
1answer
69 views

Is it wise to use HOTP (raw bytes) as a key for HMAC?

Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared ...
4
votes
1answer
113 views

Parallel authentication of encrypted data. What AE type to choose?

I've got a system with a slow data transfer channel. Transferring a message through several channels does increase the transfer speed significatnly. AES-CBC+HMAC is good except that verifying the MAC ...
4
votes
0answers
41 views

Do we still need HMAC now that SHA3 is here? [duplicate]

In Another look at HMAC from Koblitz and Menezes, they state that HMAC came along because doing h(secret || message) was vulnerable to length extension attacks. But as far as I know, these kind of ...
4
votes
0answers
54 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
1answer
901 views

Authentication using AES

I need to implement an authentication mechanism in an embedded environment which does not support floating point operations but has an AES accelerator module which allows for encyption/decryption ...
3
votes
2answers
509 views

AES-ECB as an authentication mechanism

ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication? Assume A wants to transmit an ...
3
votes
2answers
548 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
3
votes
2answers
392 views

Security issues of a MAC-then-Encrypt-then-MAC approach?

Encrypt-then-MAC does provide ciphertext integrity, but no plaintext integrity. With MAC-then-Encrypt it’s the other way around: Plaintext integrity but no ciphertext integrity. What comes to mind is ...
3
votes
1answer
990 views

CBC-MAC , fixed length, all blocks returned

CBC-MAC, with fixed length message. Is it safe to return all ciphered blocks instead of the last? My intuition says it is less secure, since is gives an attacker more information. But how could one ...
3
votes
2answers
127 views

Strange MAC algorithm

I'm working with a payment provider which uses the following algorithm for signing messages: The merchant is securely given a secret key k, known to them and the ...
3
votes
3answers
260 views

Message authentication codes construction

I was reading the paper $[1]$ and came across the scheme that I show below. While I understand the scheme well, I don't understand why they prepend a 0 to the block containing $r$ and a 1 to all other ...
3
votes
2answers
343 views

Does encrypting a hash of the message yield a secure MAC?

Is $mac = enc(hash(x))$ a secure MAC for hash = SHA256 and enc AES in CBC mode or ECB mode. Normally AES-CBC is malleable. But in this case I use a hash function for the one-way property. For ...
3
votes
1answer
248 views

Non-cryptographic hash function as MAC for stream ciphers

I understand that for a stream cipher to be useful, there must be a way to verify that the message was not tampered with (bits were flipped by an attacker). So, instead of using some cryptographic ...
3
votes
2answers
620 views

Modifications of CBC-MAC

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions. At the beginning I want to remind the ...
3
votes
1answer
286 views

Why are there no MACs inspired by block cipher modes other than CBC and CFB?

I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter. Why are CBC ...
3
votes
2answers
269 views

Is there a companion algorithm for OTP to ensure integrity and/or authentication?

One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved: Fast generation of independent and identically distributed random variables Perfect key ...
3
votes
1answer
71 views

Are deployed MACs IND-CPA?

There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk ...
3
votes
1answer
223 views

When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
3
votes
1answer
459 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
3
votes
1answer
210 views

When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?

I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w >...
3
votes
1answer
406 views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
3
votes
1answer
25 views

Encrypt-then-MAC when encrypting data in multiple blocks

Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ? For example, the plaintext is 530 bytes long. We read ...
3
votes
1answer
105 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
3
votes
1answer
269 views

Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be ...
3
votes
1answer
636 views

Advantages/disadvantages of different message numbering schemes

For a stream of packets, where each packet is individually encrypted with a block cipher, it's desirable to have each encrypted packet only valid for that position in the stream. A message number ...
3
votes
1answer
445 views

Can i modify data “protected” by a CRC16?

There are 100 bytes with a CRC16. However I only know the first 50. I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100. ...