Tag Info

New answers tagged

1

No, using a CRC in this way not secure. A CRC is not designed to be used against adversaries, it is used to detect random bit changes to the data it is protecting (as well as the CRC itself). A CRC of 16 bit will certainly not be as secure as an 8 byte MAC value, that was designed to protect against such attacks. Without additional measures a 16 bit CRC ...


1

HKDF stage 1 is useful for when the SKM value is derived using some deterministic method, such as a key exchange, or from a source that may not be fully trusted. SKM may be substantially larger than the keys you want, but may have the entropy not evenly distributed. Stage 1 compacts and distributes the entropy into a key that is correctly sized for the hash ...


1

I'm going to agree with @fgrieu's marvelous post above in a back-handed way. My answer is: No, you don't have to use an HMAC. Do it anyway. As you noted, some hashes, sush as SHA-3 (especially in its Keccak form), Skein (which I was a team member on), and others will work just fine. In the case of Skein, there is a one-pass Skein-MAC that has a proof of ...


1

Security The level of security is likely to depend on the cryptographic primitives - the actual hash function and cipher - used. It is very likely that you can construct a function that is insecure, e.g. where the cipher is used for both the hash function an encryption. So you need to prove that the hash function and the encryption primitive are not ...


4

In summary: Yes, HMAC is the way to go for construction of a MAC from an arbitrary concrete iterated hash. We have no constructive argument of security of the MAC constructs in the question; we even have a concrete attack when using some otherwise apparently fine hashes. I consider a hash constructed by iterating a compression function $F$ as ...


1

Your scheme is secure under the assumption that AES is a pseudo-random permutation (PRP): In fact, message authentication codes (MACs) are theoretically modelled as pseudo-random functions (PRFs), and any PRP is also a PRF. Therefore, your usage of single-block AES essentially is a MAC. In the case that only a very small subset of the possible blocks is ...


1

@gammatester gave most of the answer, but he didn't address the last question: would this make HMAC the only NIST approved MAC? No, as of right now, the block cipher-based Message Authentication Codes CMAC and GMAC are also approved. In addition, if you use the approved mode CCM with a empty message, that's effectively a MAC over the Additional ...


1

You will find a list of Approved security functions (message authentication among them) here on the NIST website (FIPS 140-2 Annex A: Approved Security Functions): http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Interestingly in this document #1 (Triple-DES) references FIPS 113, which leads me to believe the method in FIPS 113 is valid ...


1

The NIST site http://csrc.nist.gov/publications/PubsFIPSArch.html lists FIPS 113 as Withdrawn: Sep 2008. The Federal Register https://www.federalregister.gov/articles/2005/07/15/05-13992/proposed-withdrawal-of-ten-10-federal-information-processing-standards-fips gives a reason: FIPS 113, Computer Data Authentication, specifies an algorithm for ...



Top 50 recent answers are included