# Tag Info

## Hot answers tagged mac

11

While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth. What they are talking about is a Carter-Wegman authentication method that uses a stream of random bits as a part of the process (just like a one time pad uses a stream of random bits to encrypt). Normally, when we implement CW, we use some almost universal (au) ...

10

There are many advantages of MAC's over signatures. For signatures you need to use asymmetric key pairs. Public keys need to be trusted for this to work. Unfortunately establishing trust is not that easy. Furthermore you don't want to use a private key stored on, for instance, a smart card (which would require a PIN and would likely be too slow). Instead ...

7

MACs have some advantages over digital signatures The component of the computational cost that is independent of message size is much higher for digital signatures, to the point of being an obstacle and requiring milliseconds or/and dedicated hardware. We know no signature scheme where both signature and verification of short messages are of speed any ...

6

A simplified* Carter-Wegman MAC could be defined as: $$t=\sum_{i=1}^n {k_1^i m_i} + k_2 \pmod p$$ $p$ is a sufficently large prime (e.g. 256 bits). You must choose a new truly random $k_2$ uniformly from $0\leq k_2 <p$. It acts as a one-time-pad that prevents an attacker who sees the tag $t$ from learning anything about $k_1$. The polynomial $\sum {... 5 It is widely known, generally, that a MAC is a HASH with key. Nope; there are plenty of perfectly good MACs that, if you know the key, aren't very good hashes at all. Examples of this would include CMAC and GMAC; in both cases, if you know the key, it's easy to generate an image that MACs to a specific value. However, lets assume that you're talking ... 4 Can someone quote a protocol, application, etc, where the disadvantages of the MAC relative to digital signatures can be ignored? Your particular attack is of no interest if B has nothing to gain to claim that it got message M from A. As for concrete examples: the TLS record format, IPsec, SSH, the IES public key system; actually, any protocol that ... 4 I think the attack by Preneel and van Oorschot (MDx-MAC and Building Fast MACs from Hash Functions, CRYPTO'95) in Proposition 4 applies. It was cited by PulpSpy in reply to my question about H(pass||length(data)||data). With fixed-length data, that amounts to a known suffix for the key. Proposition 4 states in a nutshell that for a generic construction ... 3 Your attack on$S$involves computing$S'(k,m_i)$for arbitrary messages$m_1,\dots,m_q$. In order to do that, you must compute$S(k,m_i)$and$S(k,0^n)$, and thus you have obtained$S(k,0^n)$. This means that$0^n$must be added to the list of invalid forgeries, and so in order to present a valid forgery for$S$, you must have$$(m,S(k,m)) \notin \{(0^n,S(k,... 3 The key thing you're missing here is that collision resistant hash functions ("CRHFs," what we normally call just "crypto hashes") and message authentication codes ("MACs") have substantially different security goals. CRHFs must meet these goals: Collision resistance: Attacker can't easily find two messages that hash to the same value. Preimage resistance:... 3 Quoting the answer here: Padding Oracle attacks are mainly a problem in cases, where e.g. an encrypted message is modified and send to a target. These attacks try to measure the difference when decrypting and validating the message. The steps are: decrypting the message checking the padding > error if wrong checking or processing the ... 2 I'm confused at your suggestion that your clients would not have access to a public key signature facility, given that you assume that they have crypto hashes and can run code of your authorship. More generally, the fact that you're trying to roll your own crypto doesn't bode well. Also, I'd suggest that you have a hard look at the challenges implied by ... 2 I was going to make this a comment; however you asked for hint, and these are hints. Suppose you had an Oracle that solved the second game for you; how could you use that Oracle to solve the first game? Does that imply that a MAC where the first game is unsolvable imply that the second game is also unsolvable? 2 First remark: Throw at$S′$some$m\neq0^n$, and extract the value$s=S(k,0^n)$out of the tag. Then, the message$0^n$and tag$(s,s)$is our forgery. Building a forgery is exposing$m$and$m'$such as$S'(m,k) = S(m',k')$. Here you computed:$S'(k,m) = (S(k,m),s) = (\sigma,s)$and$S'(k,0^n) = (s,s)$but you do not have a collision between$(\sigma,...

1

The commit that added this double HMAC only says it improves "valid MAC detection", but it simultaneously adds the constant-time comparison, so likely the reason is indeed defense against timing attacks: Improve valid MAC detection Implement constant time string comparison as well as double HMAC verification for encryption MACs. Double HMAC is a ...

Only top voted, non community-wiki answers of a minimum length are eligible