# Tag Info

3

If we assume that AES is a pseudorandom permutation (which is a standard model for block ciphers), then AES can replace the HMAC in your construction. Be aware, this only works because you have a fixed message length, i.e. the protocol must not accept nonces $> 128$bit. Besides, I guess you are aware of this but you have a shared secret key among all ...

2

Correctly implemented, it should be secure deterministic authenticated encryption. In fact, it is SIV, in the wider sense of using the "SIV construction" as defined in Deterministic Authenticated-Encryption by Rogaway and Shrimpton (except for lacking a header input). The proof of the security of the SIV construction is that: We will now show that if $F$ ...

2

It appears there are no official test vectors for PBKDF2-HMAC-SHA256. A StackOverflow user has posted some test vectors that others have validated. Here are the test vectors for HMAC-SHA2 which you should also be running. That said, if you have "implemented some other things that will make the final output different", then you do not have PBKDF2. PBKDF2 is ...

1

Yes, that's fine where TOTPs are generated in accordance with RFC 6238; this is because the time is combined with the secret before generating the HMAC. This means that it isn't practically possible to derive the time (or information about it, such as the time difference) based on the key alone because of the Avalanche effect in the hashing algorithm that is ...

1

Now I would like to use a single-block AES128 for the HMAC calculation in this scheme [...] HMAC requires a hash function with a variable input size, so you cannot just use AES in it. If you want to use some other MAC instead of HMAC, you can use AES. AES ECB is a secure MAC for single block messages, so that would work. Given this answer to a ...

1

A few things. First of all, MD5 is broken, and no longer suitable for cryptographic purposes. Instead, prefer newer algorithms, like those from the SHA-2 family (SHA-256, SHA-512, etc). Second, the term "signature" in cryptography is defined more narrowly than you would expect. It specifically refers to situations where there is a public key (the ...

1

I see no obvious security flaws, but it seems inefficient and is nonstandard. You would be better off always using the root key as the HMAC key and basing the HMAC message/data on only the key index (or other identity) rather than previous keys. That way you can create any of the keys independently. That is essentially what HKDF does in HKDF-Expand. If you ...

Only top voted, non community-wiki answers of a minimum length are eligible