Hot answers tagged

4

One of the main differences is that Message Authentication Codes don't prove authorship of the message. Imagine the situation, when Bob sent a signed contract to Alice. In case of digital signature Alice can go to court claiming that Bob has signed the contract. A judge can verify the signature and make sure that the contract was really signed by Bob as only ...


2

The reason for the padding (and re-positioning of the AAD length) in the later draft is to make implementations easier and faster - i.e. not for a security reason. The rationale for this change was actually documented on the CFRG mailing list by Alyssa Rowan: Instead of the lengths directly following their ciphertexts: ...


2

Which cryptographic algorithm would they want to use? That will really depend on the situation. To select the algorithms one should ask himself (at least) the following questions: Which standards do you trust? Which standard do you have to use? What computations can you afford? Symmetric, or public key based? It again depends on the situation. ...


2

It's trivial to calculate collisions because the message blocks M1..Mn can be interchanged without issue. So EK(M1 XOR M2) = EK(M1' XOR M2') where M1' = M2 and M2' = M1. Different messages should obviously not calculate to the same MAC authentication tag.


1

This depends on the MAC because there are different kinds of attacks to consider. If the best attack is randomly trying authentication tags, then the key does not matter. If the best attack is brute forcing the key, then key renewal does mean that the attacker has to "start anew", but as long as the key space is large enough that the probability of finding ...


1

It seems to me that the answer to the question, as literally asked, is $0$. This is because you're asking for the minimum advantage "for every adversary", and the set of possible adversaries includes e.g. the trivial adversary that simply always outputs an empty message and a random tag $t \in T$, and thus has a probability of exactly $1/|T|$ of successful ...


1

I am answering on the basis of this paper (pdf) linked in the comments, as well as some of the related papers it cites or is cited by. I am not aware of more realistic attacks on HMAC. It assumes a DPA side channel that leaks the number of bits flipped when a new value is read into a CPU register (or in another instruction in some of the papers). I.e. it ...


1

The problem is with XOR-ing the message blocks together to make a single compressed block. This reduces the message in a highly regular way, meaning it would be very easy to construct collisions. A length extension attack on this MAC design can consist of any data at all provided one of the blocks was the binary complement of the remainder - trivial to ...



Only top voted, non community-wiki answers of a minimum length are eligible