(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.
56
votes
5answers
6k views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
11
votes
2answers
891 views
Why is H(k||x) not a secure MAC construction?
If H(m) is a secure hash function, can't we implement a MAC using H(k||m)?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash functions for ...
11
votes
3answers
267 views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
9
votes
4answers
441 views
Can you make a hash out of a stream cipher?
A comment on another question made me wonder about something:
Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
8
votes
3answers
406 views
UMAC: to what extent is it in use today?
Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ...
8
votes
1answer
331 views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mid\mid x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k ...
6
votes
3answers
205 views
Why is a MAC needed?
I agree that for certain encryption systems or modes of operation, a MAC is indispensible.
The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
6
votes
1answer
1k views
Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?
A fixed length CBC-MAC uses an all-zero block as the initialization vector.
Suppose that we used a randomized IV instead, and sent the IV along with the tag.
So if the message $m$ will be $m = b_1 || ...
6
votes
1answer
553 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
6
votes
2answers
251 views
Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant Merkle–Damgård hash function $\mathcal{H}$ (e.g. SHA-1, RIPEMD-160, SHA-256, SHA-512). We define a Message Authentication Code $\mathcal{C}$
$$(k,m) ...
5
votes
1answer
2k views
HMAC vs MAC functions
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.
What are principle differences?
When to use one and when the other?(Typical Use Cases)
5
votes
1answer
321 views
Why are MACs in general deterministic, whereas digital signature constructions are randomized?
The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
5
votes
2answers
499 views
Encrypt-then-MAC Confidentiality, Integrity and Authenticity
Does Encrypt-then-MAC provide equal confidentiality, integrity and authenticity as other constructs such as EAX?
If yes, how do I go about using it?
My current understanding is:
E = ...
4
votes
3answers
149 views
Can I jettison MAC if I already have SHA1(M)?
I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M. Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only ...
4
votes
2answers
190 views
Is SHA1 secure with such many inputs Z that Z = constant secret X + variable public Y?
Let me ask whether SHA1 is designed to be secure for the following case.
You compute each SHA1 of many strings,for example 1 million, where each string is a concatenation of X+Y ,
where X is secret ...
4
votes
2answers
623 views
What is the purpose of four different secrets shared by client and server in SSL/TLS?
I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including
client write mac secret,
server write mac secret,
server write key,
client ...
4
votes
2answers
143 views
ChaCha cipher + Poly1305
The Poly1305-AES paper summarizes the MAC as
$$ Poly1305(m, AES_k(n)) = {H_r(m) + AES_k(n)} \mod 2^{128} $$
Can I presume that $+$ here is just meant as a form of 16-byte mixing $H_r(m)$ and ...
4
votes
2answers
245 views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = ...
4
votes
1answer
126 views
What are the consequences of a MAC tag collision?
I've seen some proofs of MAC security that are based on the extremely-unlikely event that two MAC tags collide (ie, they are equal for distinct messages). Suppose that this extremely unlikely event ...
4
votes
2answers
216 views
Cost of attacking Mobile OTP with a fake server
You want to obtain a 74-bit secret $K$. There is an oracle that will provide you with the following value for several values of $T$:
...
4
votes
1answer
58 views
Can Poly1305 be used with block ciphers running in CTR mode?
Is the use of Poly1305 limited to stream ciphers? (note, I'm not talking about Poly1305-AES )? Can it be used with block ciphers running in CTR mode? If so, what other considerations/limitations are ...
3
votes
1answer
177 views
CBC-MAC , fixed length, all blocks returned
CBC-MAC, with fixed length message.
Is it safe to return all ciphered blocks instead of the last?
My intuition says it is less secure, since is gives an attacker more information.
But how could one ...
3
votes
1answer
549 views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
3
votes
2answers
212 views
Why is h(m||k) insecure?
Here is the post that explains the failure for doing h(k||m) and I understand it.
But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain?
3
votes
1answer
183 views
How safe is it to derive MAC key from a hashed password?
Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
3
votes
1answer
179 views
What type of hash functions provides non-malleability of hash digests?
I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment.
A simple deterministic commitment ...
3
votes
1answer
97 views
Can i modify data “protected” by a CRC16?
There are 100 bytes with a CRC16. However I only know the first 50.
I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100.
...
3
votes
1answer
66 views
When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?
I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w ...
3
votes
1answer
165 views
Using a derived key for CMAC
Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication:
Two keys are derived from the master key k (16 byte): ...
2
votes
2answers
327 views
What is the difference between MAC and HMAC?
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
2
votes
2answers
244 views
Modifications of CBC-MAC
I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions.
At the beginning I want to remind the ...
2
votes
1answer
65 views
Why is H(message||secret_key) not vulnerable to length-extension attack?
Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$.
Why can't he perform the same ...
2
votes
1answer
79 views
Encrypt-then-MAC paradigm
I read that the Encrypt-then-MAC paradigm is provably secure.
From what I understand, when using for example AES for encryption and HMAC_SHA256 for MAC generation (and the keys $K_1 \neq K_2$), this ...
2
votes
1answer
60 views
Using UMAC with stream cypher
I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
2
votes
1answer
95 views
Has GMAC mode a future outside GCM?
Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
2
votes
1answer
90 views
What “Tag Length” should be used for the EAX MAC?
Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ...
2
votes
1answer
501 views
ANSI X9.9 Cryptography Standards
I'm trying to create a ISO8583 Rev93 message.
What is the standard way of generating MAC key in ANSI X9.9
DES-CBC encryption algorithm is used to encrypt the ...
2
votes
1answer
104 views
How to design a practical and secure MAC scheme?
I am sorry, but I need to introduce some concepts which are not directly related to cryptography to make myself clear, I hope I won't stun you with this ... (I'd rather explain it here than redirect ...
1
vote
3answers
181 views
Realize a MAC using a Pseudo-random function?
Given a pseudo-random function and assuming that we do not have any other tools,
How can we construct a MAC?
I believe this can be done. Would like to know if there is more than one way of doing ...
1
vote
3answers
151 views
Message authentication codes construction
I was reading the paper $[1]$ and came across the scheme that I show below. While I understand the scheme well, I don't understand why they prepend a 0 to the block containing $r$ and a 1 to all other ...
1
vote
2answers
70 views
Encrypting and MACing different data with same key
It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
1
vote
1answer
80 views
Non-cryptographic hash function as MAC for stream ciphers
I understand that for a stream cipher to be useful, there must be a way to verify that the message was not tampered with (bits were flipped by an attacker).
So, instead of using some cryptographic ...
1
vote
1answer
106 views
Why do we need extra hashing if we could use simpler scheme?
Lets say that we use init vector IV, key K and HMAC key H. Message is M.
Mode of operation is CBC !!!
We usually encrypt as this
...
1
vote
1answer
401 views
1
vote
4answers
172 views
Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data?
I am designing a simple and secure stream communication protocol. My idea was to build each message sent to the wire as:
(message size || clear text || UHASH(message size || clear text)) $\oplus$ ...
1
vote
2answers
78 views
How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?
I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars.
...
1
vote
1answer
186 views
How do unkeyed hash functions (for MDCs) provide security?
Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash ...
1
vote
1answer
259 views
Is this fixed length MAC unforgeable?
Consider the following fixed length MAC for messages of length $\ell(n)=2n-2$ using a pseudorandom function $F$:
On input of a mesage $m_0||m_1$ ($|m_0| = |m_1| = n-1$) and a key $k \in \{0,1\}^n$, ...
1
vote
1answer
43 views
Secure MAC implies that probability of same tags on different messages is negligible
So let any secure MAC (message authentication code) be given.
Intuitively, I think it is clear that the probability of getting the same tag on two different messages is very small, i.e. negligible. I ...
1
vote
0answers
38 views
How does Poly1305 in the NaCl library calculate a MAC?
I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl. My understanding of XSalsa20Poly1305 (in this ...
