(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

1
vote
1answer
189 views

Block ordering and security in a MAC?

To authenticate a message $m = m_1 \,\|\, \dots \,\|\,m_n$ the tag $t := F_k(r) \oplus F_k(m_1) \oplus \dotsb \oplus F_k(m_n)$ is used, where r is uniform random number $(0,1)^n$ and $m=(0,1)^n$. Even ...
3
votes
1answer
126 views

What “Tag Length” should be used for the EAX MAC?

Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ...
10
votes
4answers
760 views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
5
votes
2answers
266 views

Cost of attacking Mobile OTP with a fake server

You want to obtain a 74-bit secret $K$. There is an oracle that will provide you with the following value for several values of $T$: ...
4
votes
2answers
220 views

Is SHA1 secure with such many inputs Z that Z = constant secret X + variable public Y?

Let me ask whether SHA1 is designed to be secure for the following case. You compute each SHA1 of many strings,for example 1 million, where each string is a concatenation of X+Y , where X is secret ...
1
vote
1answer
459 views

Is this fixed length MAC unforgeable?

Consider the following fixed length MAC for messages of length $\ell(n)=2n-2$ using a pseudorandom function $F$: On input of a mesage $m_0||m_1$ ($|m_0| = |m_1| = n-1$) and a key $k \in \{0,1\}^n$, ...
2
votes
3answers
256 views

Realize a MAC using a Pseudo-random function?

Given a pseudo-random function and assuming that we do not have any other tools, How can we construct a MAC? I believe this can be done. Would like to know if there is more than one way of doing ...
3
votes
1answer
307 views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
3
votes
1answer
939 views

ANSI X9.9 Cryptography Standards

I'm trying to create a ISO8583 Rev93 message. What is the standard way of generating MAC key in ANSI X9.9 DES-CBC encryption algorithm is used to encrypt the ...
3
votes
1answer
257 views

How safe is it to derive MAC key from a hashed password?

Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
4
votes
1answer
148 views

What are the consequences of a MAC tag collision?

I've seen some proofs of MAC security that are based on the extremely-unlikely event that two MAC tags collide (ie, they are equal for distinct messages). Suppose that this extremely unlikely event ...
11
votes
1answer
675 views

Is H(k||length||x) a secure MAC construction?

If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mid\mid x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k ...
7
votes
2answers
2k views

What is the purpose of four different secrets shared by client and server in SSL/TLS?

I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including client write mac secret, server write mac secret, server write key, client ...
7
votes
1answer
2k views

Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?

A fixed length CBC-MAC uses an all-zero block as the initialization vector. Suppose that we used a randomized IV instead, and sent the IV along with the tag. So if the message $m$ will be $m = b_1 || ...
6
votes
2answers
887 views

Encrypt-then-MAC Confidentiality, Integrity and Authenticity

Does Encrypt-then-MAC provide equal confidentiality, integrity and authenticity as other constructs such as EAX? If yes, how do I go about using it? My current understanding is: E = ...
9
votes
3answers
593 views

UMAC: to what extent is it in use today?

Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ...