Hot answers tagged

12

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC definition implies this. Indeed, it clearly does not. So, conceptually, you need a pseudorandom function. You can assume that HMAC is a pseudorandom function. It is ...


3

Like Yehuda Lindell already wrote, MAC does not imply PRF, which is pretty much what you would want from a KDF. Additionally, some of your assumptions are not correct: A key and data as input and an output that has the same length as the input key; This is frequently not the case with MACs. For example, when you use any MAC based on AES-256 (...


3

There is work underway to specify KMAC. It's basically just SHA-3, but with a length specification for the key and a special value to indicate that this is KMAC instead of hashing. These constructions are required to make sure that there are no unfortunate collisions with previously hashed data or - more importantly - key / message pairs where $H(K_1,M_1) = ...


2

I think you have the right idea; here's a more formal way of saying it. A MAC is secure if an attacker who, given an Oracle that can generate MACs for messages (with a secret random key), cannot (with nontrivial probability) generate a valid Message, MAC pair for a Message he has not queried the Oracle. For $Mac'$, what the attacker could do is select a ...



Only top voted, non community-wiki answers of a minimum length are eligible