Tag Info

Hot answers tagged

5

NMAC is really just an "education tool" on the way to HMAC and I don't think anyone intended it to be used. The two keys are needed since the first and second hashes have different purposes. The first hash on the message is just needed to get collision resistance, whereas the second hash is supposed to provide a pseudorandom function type property. As such, ...


4

I'll answer in order: Output size = input size That's correct, GCM uses CTR internally. It encrypts a counter value for each block, but it only uses as many bits as required from the last block. CTR turns the block cipher into a stream cipher. IV of any size For GCM a 12 byte IV is strongly suggested as other IV lengths will require additional ...


2

A lot has changed recently in this area. Now the only ciphersuites Chrome considers non-obsolete (those that use AES-GCM or ChaCha+Poly1305), do use Carter-Wegman MACs. So, I would say that there is no disadvantage and that any low popularity has been just an artifact of historical decisions in standardization. Secure hashes were the first to be openly ...


1

Concatenating two copies of your message is unnecessary and is equivalent to padding out your 64 bit message to the full 128 bits with zeros from a security standpoint (which happens automatically in the encryption process). Would they be able to securely authenticate the message? I assume you mean Authenticated Encryption. The simple answer is no. ...


1

You cannot change the hash size without altering TLS: From: Appendix C. Cipher Suite Definitions MAC Algorithm mac_length mac_key_length -------- ----------- ---------- -------------- NULL N/A 0 0 MD5 HMAC-MD5 16 16 SHA HMAC-SHA1 20 20 SHA256 HMAC-SHA256 32 ...


1

Use AES-OCB. It is patented, but now has a free license for any non-military software use. Unlike most other CAESAR candidates, OCB has been scrutinized for a while now, and meets all of your criteria other than 6 (assuming you have a good AES implementation). If the patent is simply too much for you, then use a heavily scrutinized patent-free tweakable ...



Only top voted, non community-wiki answers of a minimum length are eligible