New answers tagged

0

The authenticator needs to send "Group Key" to the supplicant. This is why the 3rd message is required, therefore the 4th as an ack from supplicant to authenticator.


13

It is well defined. The hash function has no impact on whether HMAC is defined for a null string text argument. As long as HMAC is defined for a particular hash function, the resulting HMAC of a null string text argument should also be well defined. The definition of HMAC according to FIPS 190-1 is: $HMAC(K, text) = H((K_0 \oplus opad)|| H((K_0 \oplus ...


4

The data input to HMAC (which is passed directly to the underlying hash function, after prepending the padded and masked key to it) is an arbitrary string of bytes. In particular, the zero-length string is a perfectly valid input. Of course, if you're using a wrapper around HMAC that encodes some kind of structured data into a byte string before passing it ...


4

No, you should not use a password directly as an HMAC key. However, it is fine to use HMAC as part of a key derivation function, which generates keys from a password. However, do not mistake the output as naturally having higher entropy than whatever you put in. "password" has essentially 0-bits of entropy, and running it through a KDF will not magically ...


3

RFC4868 is not the HMAC RFC, which is actually RFC 2104. 4868 refers to the use of HMAC within IPSEC, which is why there is a key length restriction. The maximum length key that can be used internally with HMAC-SHA256 is equal to the block size, 64 bytes or 512 bits. This can be useful in cases where the key is not full entropy such as the shared secret ...


1

The question why these things are chosen is not really answerable, except by the persons involved at NIST. I don't think there is too much to test though; after you test a few vectors you're testing the hash function rather than the HMAC. A quick test shows the test vector in RFC 4868 2.7.2.1. SHA256 Authentication Test Vectors to be correct, in case you ...


1

I am answering on the basis of this paper (pdf) linked in the comments, as well as some of the related papers it cites or is cited by. I am not aware of more realistic attacks on HMAC. It assumes a DPA side channel that leaks the number of bits flipped when a new value is read into a CPU register (or in another instruction in some of the papers). I.e. it ...


2

A similar question as been asked before: Use cases for CMAC vs. HMAC? To resume it, AES-CMAC is a MAC function. It can be seen as a special case of One-Key CBC MAC1 (OMAC1) which also a MAC function that relies on a block cipher (so AES in the present case). HMAC is also a MAC function but which relies on a hash function (SHA256 for HMAC-SHA256 for ...


3

In the context of most Password Managers that use encryption, you will generate a Master Data Encryption Key (MDEK) which will serve to encrypt all the passwords and the user's password would be the Key Encrypting Key (KEK) to encrypt the MDEK. This way, the MDEK stays the same when you change your Master Password derived KEK that wraps the MDEK.


0

Ilmari Karonen's answer is correct when HMAC is used for its intended purpose, but that doesn't mean that HMAC is completely unaffected by MD5's collisions: Given a specific Key, note that K xor opad and K xor ipad are independent of the message m. This means that any collision in H((K xor ipad) || m) will result in a colliding HMAC, even with two ...



Top 50 recent answers are included