Hot answers tagged

4

Some amount of known or controlled plaintext is clearly required for the attacker to get the block cipher output. Actually, that's not much of an issue; we can often get a reasonable amount of known plaintext from real encrypted messages. In fact, the known plaintext for each message doesn't have to be the same, and you don't have to have completely ...


3

RFC4868 is not the HMAC RFC, which is actually RFC 2104. 4868 refers to the use of HMAC within IPSEC, which is why there is a key length restriction. The maximum length key that can be used internally with HMAC-SHA256 is equal to the block size, 64 bytes or 512 bits. This can be useful in cases where the key is not full entropy such as the shared secret ...


1

The question why these things are chosen is not really answerable, except by the persons involved at NIST. I don't think there is too much to test though; after you test a few vectors you're testing the hash function rather than the HMAC. A quick test shows the test vector in RFC 4868 2.7.2.1. SHA256 Authentication Test Vectors to be correct, in case you ...



Only top voted, non community-wiki answers of a minimum length are eligible