# Tag Info

2

I think the attack by Preneel and van Oorschot (MDx-MAC and Building Fast MACs from Hash Functions, CRYPTO'95) in Proposition 4 applies. It was cited by PulpSpy in reply to my question about H(pass||length(data)||data). With fixed-length data, that amounts to a known suffix for the key. Proposition 4 states in a nutshell that for a generic construction ...

3

Your attack on $S$ involves computing $S'(k,m_i)$ for arbitrary messages $m_1,\dots,m_q$. In order to do that, you must compute $S(k,m_i)$ and $S(k,0^n)$, and thus you have obtained $S(k,0^n)$. This means that $0^n$ must be added to the list of invalid forgeries, and so in order to present a valid forgery for $S$, you must have (m,S(k,m)) \notin \{(0^n,S(k,...

2

First remark: Throw at $S′$ some $m\neq0^n$, and extract the value $s=S(k,0^n)$ out of the tag. Then, the message $0^n$ and tag $(s,s)$ is our forgery. Building a forgery is exposing $m$ and $m'$ such as $S'(m,k) = S(m',k')$. Here you computed: $S'(k,m) = (S(k,m),s) = (\sigma,s)$ and $S'(k,0^n) = (s,s)$ but you do not have a collision between $(\sigma,... 1 The commit that added this double HMAC only says it improves "valid MAC detection", but it simultaneously adds the constant-time comparison, so likely the reason is indeed defense against timing attacks: Improve valid MAC detection Implement constant time string comparison as well as double HMAC verification for encryption MACs. Double HMAC is a ... 3 Like Yehuda Lindell already wrote, MAC does not imply PRF, which is pretty much what you would want from a KDF. Additionally, some of your assumptions are not correct: A key and data as input and an output that has the same length as the input key; This is frequently not the case with MACs. For example, when you use any MAC based on AES-256 (... 15 No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC definition implies this. Indeed, it clearly does not. So, conceptually, you need a pseudorandom function. You can assume that HMAC is a pseudorandom function. It is ... 3 There is work underway to specify KMAC. It's basically just SHA-3, but with a length specification for the key and a special value to indicate that this is KMAC instead of hashing. These constructions are required to make sure that there are no unfortunate collisions with previously hashed data or - more importantly - key / message pairs where$H(K_1,M_1) = ...

2

I think you have the right idea; here's a more formal way of saying it. A MAC is secure if an attacker who, given an Oracle that can generate MACs for messages (with a secret random key), cannot (with nontrivial probability) generate a valid Message, MAC pair for a Message he has not queried the Oracle. For $Mac'$, what the attacker could do is select a ...

Top 50 recent answers are included