(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

learn more… | top users | synonyms

0
votes
0answers
53 views

Explanation of cryptographic terminology for newbies [on hold]

I feel like I'm making a mountain out of a molehill here, but I have (what should be) a relatively simple project, but the terminology used all over the Internet is either too simple or too difficult ...
9
votes
2answers
938 views

Can any MAC be used as a KDF?

First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
-1
votes
0answers
23 views

Counter-Mode Message Authentication Code [duplicate]

Excuse my naivety,I don't know much about crypto. But I've been wondering, couldn't counter-mode be used for MAC just like CBC in CBC-MAC, assuming nonce for the counter is not repeated? Am I missing ...
4
votes
0answers
41 views

Do we still need HMAC now that SHA3 is here? [duplicate]

In Another look at HMAC from Koblitz and Menezes, they state that HMAC came along because doing h(secret || message) was vulnerable to length extension attacks. But as far as I know, these kind of ...
7
votes
2answers
535 views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
1
vote
0answers
46 views

Safe MAC proof check

Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$. Is the following $MAC$ safe? Show your proof. $Mac'(k,m) = Mac(k, m)$ $Vrfy'(k,m,t) = \{Vrfy(...
1
vote
1answer
74 views

Security of a MAC

Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$. Is the following $MAC$ safe? Show your proof. $Mac'(k,m) = Mac(k, m ⊕ m)$ $Vrfy'(k,m,t) = ...
20
votes
4answers
3k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
1
vote
1answer
53 views

SIV - Synthetic IV - S2V Construction? Benefits over a MAC or Hash?

Looking at the SIV construction in rfc-5297 - https://tools.ietf.org/html/rfc5297 With regards to the generation of the SIV, using S2V construction, I am struggling to find the benefits of the chosen ...
2
votes
1answer
159 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...
11
votes
3answers
981 views

UMAC: to what extent is it in use today?

Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ...
3
votes
1answer
25 views

Encrypt-then-MAC when encrypting data in multiple blocks

Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ? For example, the plaintext is 530 bytes long. We read ...
3
votes
2answers
2k views

ANSI X9.9 Cryptography Standards

I'm trying to create a ISO8583 Rev93 message. What is the standard way of generating MAC key in ANSI X9.9 DES-CBC encryption algorithm is used to encrypt the ...
2
votes
1answer
38 views

Is this hash function almost XOR universal?

Consider this hash function: The key $K$ is $2^n$ bits. The message $M$ is divided into $2^n$ bit blocks. Arithmetic is performed modulo $2^{n+1}$. The hash is defined by: $ H_0 = 1 $. $H_{i+1} = ...
2
votes
2answers
547 views

Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
2
votes
1answer
54 views

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures Questions: why ...
1
vote
0answers
61 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
1
vote
1answer
32 views

Why does Carter-Wegman MAC have 2n-bit output?

The Coursera course on Cryptography 1 has a section about Carter-Wegman MAC. Here is the image of slide: Now my question is both $F$ and $S$ output $n$-bit strings. We XOR two $n$-bit strings and we ...
1
vote
1answer
46 views

Difference between single-pass and two-pass MACs

I am having trouble understanding where the count of "passes" come in. What constitutes a pass in the context of message authentication codes? How are single-pass MACs achieved?
2
votes
1answer
62 views

SipHash's (non-)collision resistance

I'm very new to cryptography, and I need help understanding the security claims made in Aumasson and Bernstein's paper on the SipHash. In particular, I'm trying to understand the following statement ...
4
votes
1answer
54 views

Prove that the following MAC is insecure

I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved: Gen generates a uniform $k \in \{0, 1\}^n$. To ...
1
vote
2answers
82 views

Is a PRF applied to a secure MAC also a secure MAC?

Suppose I apply a PRF to a secure MAC. Do I still have a secure MAC?
4
votes
2answers
73 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
0
votes
1answer
58 views

Creating a message authentication scheme

I have such situation. I have a device like dongle. But it has certain limitations. For example, it can only have implemented encryption and decryption functionality. The availability of ciphers ...
0
votes
0answers
41 views

Non CPA on custom MAC

While preparing for a crypto exam there is a task we don't really understand: task Let $E_K$ be a permutation $\{0,1\}^b \rightarrow \{0,1\}^b$ defined by a blockcipher with the key $K$. Let $M = (...
0
votes
0answers
27 views

MAC is constructed by hashing and then encrypting

Suppose the MAC is constructed by hashing and then encrypting, that is $MAC(m, k2)=E_{k2}(H(m))$ where H is a public hash function. There can be several alternatives in how the transmitted message is ...
3
votes
2answers
548 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
1
vote
1answer
252 views

Do I need to use a MAC with asymmetric encryption?

The internet has drilled into me that when I delivery any symmetrically encrypted data, I should also deliver a MAC to authenticate it before any decryption occurs. Do I also need to do this if I use ...
0
votes
3answers
115 views

About MAC and HMAC

I'm studying mechanisms of integrity and authentication in symmetric encryption scenarios. I want to propose some examples to see whether I got the point here: Let $m$ be the message, $c$ the ...
192
votes
11answers
47k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
4
votes
0answers
54 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
1answer
89 views

Authenticated encryption with Signatures

I've given a CPA secure private key encryption scheme (wich gets to a CCA secure scheme or better to an authenticated encryption scheme, when i combine it with a given MAC) and a unforgeable public ...
13
votes
3answers
351 views

Why is Poly1305 popular given its 'sudden death' properties?

ECDSA has the undesirable property that if a key pair reuses a nonce in a signing operation, the cryptosystem experiences catastrophic failure in the form of private key leakage. I've heard this ...
0
votes
1answer
35 views

A simple keyed message authentication code using XOR

Suppose I have a key that is at least 32 characters in length and provides at least 128-bits of entropy. If I picked from the character set of [a-hjkmnp-z2-9-], ...
0
votes
1answer
26 views

Uniqueness of checksums using DES-MAC encryption?

I'm in an Intro to Computer Security class, and one concept I'm having trouble understanding is how two different files could produce the same checksum. How would you produce the same checksum given ...
1
vote
0answers
20 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
1
vote
2answers
96 views

Difference between MAC and Authenticated Encryption?

I am currently studying authenticated encryption and I was wondering if there was a difference between using a MAC and authenticated encryption. It seemed like authenticated encryption schemes use ...
0
votes
0answers
26 views

Using Counters instead of MAC in CBC mode

I am wondering what are the implications of using a session counter appended to the end of a plaintext and then use a cipher in CBC mode to encrypt it vs. adding a HMAC or some form of keyed MAC to ...
2
votes
1answer
60 views

Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?

I am preparing for an exam and trying to solve the following question I found on the internet: Let $F_k$ be a pseudorandom function. Show that the following MAC for messages of length $2n$ is ...
1
vote
0answers
73 views

Confidentiality then Integrity with different keys

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
1
vote
1answer
83 views

Understanding WPA2 authentication in details

As far as I know, WPA2 authentication consists of a 4-way handshake. The first message is from the AP, containing the ANounce, a random number generated by the AP, The second message is from the ...
2
votes
1answer
95 views

Parallel variant of Carter-Wegman MAC with incremental property

Is there any variant of the Carter-Wegman MAC algorithm that is fast, parallel and has the property of incremental crypto?
6
votes
1answer
328 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
0
votes
1answer
39 views

How would the opponent defraud this secure communication?

I am new in the cryptography and the information security problems, I try to understand things as much as I can and I know it's really complicated in the beginning. Considering the communication ...
3
votes
1answer
97 views

Padding in PMAC

How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding. I find the ...
5
votes
1answer
91 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
2
votes
0answers
35 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
-1
votes
2answers
86 views

How do they implement MAC in TLS?

I recently read questions about "MAC then Encrypt/Encrypt then MAC" which made me curious about how they actually use the algorithm. MAC only calculated once either case (according to what I read). ...
1
vote
0answers
42 views

Can an attacker recover the key if a Poly1305 collision is known?

Suppose that messages $m_1$ and $m_2 \neq m_1$, both known to the attacker, are both MAC'd through Poly1305 with the same key. By chance, these two messages hash to the same value. The attacker ...
7
votes
1answer
258 views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...