# Tag Info

0

Actually, there are Carter-Wegman MACs that work like this; of course, there the "hash" function is not a cryptographical hash function, but instead it is an almost-universal hash (with a key). If we replace this almost-universal hash, well, we run into some potential problems. The first one is the malleability of some encryption methods. If we were to ...

1

Well, you have it right in how nonces are used to make sure that the keys in different SSL sessions; this effectively prevents someone from taking an SSL record from one session, and injecting it into another -- because the keys aren't the same, it won't pass the integrity tests. However, that's not the only place we care about replay attacks; we can also ...

2

That's a lot of questions, I'll try and answer in order. A hash or message digest alone is not secure because anybody can calculate and thus substitute a hash value. If you (correctly) add a key to the mix then you get a HMAC, which can be used. Nowadays often a HMAC is used, or an authenticated mode of authentication such as GCM, CCM (for packet ...

1

For question (1): This page gives some hints on IVs and CBC: https://defuse.ca/cbcmodeiv.htm I copy-paste the part about IVs "predictability" Chosen-Plaintext Attacks Randomness is not enough, though. IVs have to be unpredictable, too[2]. Suppose there is a CBC-mode encryption system that selects a random IV, publishes it, asks the user ...

0

If the MAC is well designed and there is no better attack than guessing, the attacker can choose at least two attacks: a. Find the key for MAC and be able to sign any message. b. Guess (maybe randomly) a MAC of an arbitrary message. (If unsuccessful, maybe retry the attack.) The feasibility of attack a depends on the size of the key, but not on the size ...

3

It is certainly wrong to state that "MAC can only be produced with AES in CBC and CFB mode", but there seems to be a simple reason that people were inspired by these modes when thinking up possible MAC constructions: They carry along some state that incorporates information from the message while traversing the input blocks. In both modes, encrypting a block ...

1

Yes. $\:$ However, note that also using $K$ in the ordinary way would be a huge vulnerability, since learning $H(K,m_1)$ would allow anyone to authenticate $m_1$ together with arbitrary messages $m_2$. The two solutions $H(K,$prefixfree$\hspace{.02 in}(m_1)\hspace{.02 in}||\hspace{.02 in}m_2)$ and if $\: \operatorname{length}(m_2) < ... 1 If the hashing function$H$is secure, then$H(H(K, m_1), m_2)$is secure. But at the cost of applying$H\$ twice.

Top 50 recent answers are included