New answers tagged

1

The answer "GCM is a good option as it combines encryption and integrity in one mechanism. " is a bit misleading. GCM uses one after another: 1-st encryption in counter mode and then GHASH to authenticate the data. In the recent intel processors CLMUL-NI is used to speed up the GHASH operations. Benefits of GCM over CBC+HMAC: is much faster, as the ...


3

Which MAC algorithm is faster - CBC based MAC's or HMAC - depends completely on which ciphers and hashes are used. Furthermore, it depends on the runtime environment that contains the hash and cipher implementations. With regard to the leading CPU architecture for PC's, there are the Intel whitepapers. Both AES and SHA-2 performance can be enhanced using ...


2

Is that backtracking-resistant? No, as mentioned in the comments, if the PRF itself can be inverted when you know the key, the PRG is not backtracking resistant. I thought it would be backtracking resistant because if we compromise the internal state of the PRG at time $t+1$ (meaning the adversary gets $k$ and $B_{i+1}$), then we can't find any of the ...


0

Question: Is it safe to apply step 3 in terms of: can the password key be (easily) determined because it is known that it is the message to be hashed? Yes, this should be fine, although you might as well use a constant as the message input when calculating the HMAC. Theoretically some implementation could be more lax with regard to side channel attacks ...


4

I think the attack by Preneel and van Oorschot (MDx-MAC and Building Fast MACs from Hash Functions, CRYPTO'95) in Proposition 4 applies. It was cited by PulpSpy in reply to my question about H(pass||length(data)||data). With fixed-length data, that amounts to a known suffix for the key. Proposition 4 states in a nutshell that for a generic construction ...


1

In principle, a signature can always be used in lieu of a MAC. You use a MAC when you want the legitimate recipient of a message to be able to verify its authenticity. With a signature, everyone, including of course the legitimate recipient, can verify the authenticity of a message. The reason we use MACs at all, instead of just using signatures all the ...


1

The commit that added this double HMAC only says it improves "valid MAC detection", but it simultaneously adds the constant-time comparison, so likely the reason is indeed defense against timing attacks: Improve valid MAC detection Implement constant time string comparison as well as double HMAC verification for encryption MACs. Double HMAC is a ...


1

I was doing something like this, and discovered just how careful you need to be. I wanted to do password encryption using widely available primitives so that I could do re-keying within MySQL easily. I was already doing AES256 CTR and following the prescribed usage to the letter. fileKey = random256Bits() ivPerWrite = random256Bits() //version 1 of the ...



Top 50 recent answers are included