New answers tagged

3

The key thing you're missing here is that collision resistant hash functions ("CRHFs," what we normally call just "crypto hashes") and message authentication codes ("MACs") have substantially different security goals. CRHFs must meet these goals: Collision resistance: Attacker can't easily find two messages that hash to the same value. Preimage resistance:...


5

It is widely known, generally, that a MAC is a HASH with key. Nope; there are plenty of perfectly good MACs that, if you know the key, aren't very good hashes at all. Examples of this would include CMAC and GMAC; in both cases, if you know the key, it's easy to generate an image that MACs to a specific value. However, lets assume that you're talking ...


2

I'm confused at your suggestion that your clients would not have access to a public key signature facility, given that you assume that they have crypto hashes and can run code of your authorship. More generally, the fact that you're trying to roll your own crypto doesn't bode well. Also, I'd suggest that you have a hard look at the challenges implied by ...


6

A simplified* Carter-Wegman MAC could be defined as: $$ t=\sum_{i=1}^n {k_1^i m_i} + k_2 \pmod p$$ $p$ is a sufficently large prime (e.g. 256 bits). You must choose a new truly random $k_2$ uniformly from $0\leq k_2 <p$. It acts as a one-time-pad that prevents an attacker who sees the tag $t$ from learning anything about $k_1$. The polynomial $\sum {...


11

While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth. What they are talking about is a Carter-Wegman authentication method that uses a stream of random bits as a part of the process (just like a one time pad uses a stream of random bits to encrypt). Normally, when we implement CW, we use some almost universal (au) ...


0

This approach protects A and B from an external attacker who might want to mess with the message. However, it does not protect A from B or B from A. For example, A can craft a message and claim that it came from B since B is the only entity that shares this particular key with A. This property (called non-repudiation) is not unconditionally an advantage, ...


0

Usually symmetric crypto is preferred thanks to its efficiency compared with public key crypto. Its primitives are faster compared with those in public key encryption. There is is of course a tradeoff in key management: How users share their secret key in a symmetric setting? Asymmetric encryption solves this problem with the assumption of a trusted PKI, or ...


7

MACs have some advantages over digital signatures The component of the computational cost that is independent of message size is much higher for digital signatures, to the point of being an obstacle and requiring milliseconds or/and dedicated hardware. We know no signature scheme where both signature and verification of short messages are of speed any ...


-2

Public keys may not have been exchanged yet between A and B (maybe all they have at that point is a pre-shared secret).


10

There are many advantages of MAC's over signatures. For signatures you need to use asymmetric key pairs. Public keys need to be trusted for this to work. Unfortunately establishing trust is not that easy. Furthermore you don't want to use a private key stored on, for instance, a smart card (which would require a PIN and would likely be too slow). Instead ...


4

Can someone quote a protocol, application, etc, where the disadvantages of the MAC relative to digital signatures can be ignored? Your particular attack is of no interest if B has nothing to gain to claim that it got message M from A. As for concrete examples: the TLS record format, IPsec, SSH, the IES public key system; actually, any protocol that ...


0

Thanks to everyone for the hints and comments. I would like to propose you my proof by contradiction and kindly ask for a further comment. Being $\pi=(KG,TAG,VRFY)$ an uuf MAC according to the first game, we suppose that $\pi$ isn't uuf according to the second one. On the basis of this hypothesis, an attacker A can guess the secret key $k$. More formally, $...


2

I was going to make this a comment; however you asked for hint, and these are hints. Suppose you had an Oracle that solved the second game for you; how could you use that Oracle to solve the first game? Does that imply that a MAC where the first game is unsolvable imply that the second game is also unsolvable?


0

Basically the padding oracle attack works by changing specific bytes so that the padding matches the expected padding and therefore padding length. Once a byte is found that correctly generates a (not specifically the) padding then then plaintext can be found by XOR'ing this byte with the known information about the byte at that position. The receiver just ...


3

Quoting the answer here: Padding Oracle attacks are mainly a problem in cases, where e.g. an encrypted message is modified and send to a target. These attacks try to measure the difference when decrypting and validating the message. The steps are: decrypting the message checking the padding > error if wrong checking or processing the ...


4

I think the attack by Preneel and van Oorschot (MDx-MAC and Building Fast MACs from Hash Functions, CRYPTO'95) in Proposition 4 applies. It was cited by PulpSpy in reply to my question about H(pass||length(data)||data). With fixed-length data, that amounts to a known suffix for the key. Proposition 4 states in a nutshell that for a generic construction ...


3

Your attack on $S$ involves computing $S'(k,m_i)$ for arbitrary messages $m_1,\dots,m_q$. In order to do that, you must compute $S(k,m_i)$ and $S(k,0^n)$, and thus you have obtained $S(k,0^n)$. This means that $0^n$ must be added to the list of invalid forgeries, and so in order to present a valid forgery for $S$, you must have $$(m,S(k,m)) \notin \{(0^n,S(k,...


2

First remark: Throw at $S′$ some $m\neq0^n$, and extract the value $s=S(k,0^n)$ out of the tag. Then, the message $0^n$ and tag $(s,s)$ is our forgery. Building a forgery is exposing $m$ and $m'$ such as $S'(m,k) = S(m',k')$. Here you computed: $S'(k,m) = (S(k,m),s) = (\sigma,s)$ and $S'(k,0^n) = (s,s)$ but you do not have a collision between $(\sigma,...



Top 50 recent answers are included