Hot answers tagged mac
3
How does the length extension attack against $H(k||m)$ work?
For Merkle-Damgård hashes, if you know $H(x)$ but not $x$ you can still choose an $e$ and then compute $H(x||p||e)$. With $x=k||m$ you can compute $H((k||m||p)||e)=H(k||(m||p||e))$ which is a valid authentication tag for $m||p||e$.
Why doesn't it work against $H(m||k)$?
With a length extension ...
2
Generally speaking: no, it is not OK. If you're going to encrypt any data at all with this key, you shouldn't reuse it to MAC other data. Using the same key for two purposes is bad practice and has often led to security problems in the practice.
Encrypting data without MACing it is also bad practice.
Instead, I recommend you use an "authenticated ...
2
It depends on how you encrypt and mac.
If you can still choose then you should use an authenticated encryption with associated data mode (AEAD) like Galois/Counter Mode. If all data you want authenticated in a message has to be transmitted in the clear then just leave the encrypted part empty. These modes have the advantage that they were designed to use ...
1
Q2: No, Poly1305 not limited to stream ciphers. Yes, Poly1305 can be used with block ciphers running in CTR mode, if you use it appropriately.
I don't know whether the NaCl use is secure (whether NaCl uses it appropriately); I haven't tried to analyze NaCl. Given that NaCl was built by reputable cryptographers, I would be inclined to guess that it's ...
Only top voted, non community-wiki answers of a minimum length are eligible
