How to use HMAC-SHA1, HMAC-SHA2 in conjunction with AES

Question

I understand how to compute HMAC-SHA1, HMAC-SHA2 etcetera.

Please explain why/how is the resulting HMAC value is used in conjunction with AES for encryption/decryption and signing/verifying.

In particular:

1. How does HMAC interact with AES for key sizes (AES-128, AES-196 and AES-256)?
2. Is the calculated MAC encrypted using AES? And if so, why?
3. How about signing and verifying? How does the AES cipher play a role here?
4. Is it correct that the AES ciphertext is HMAC-ed for signing and the HMAC is verified?

Answer 1

Is the calculated MAC encrypted using AES? What is the purpose? How about signing and verifying? How does AEs Play a role here? Is the case here that the encrypted AES is HMACed for signing and the HMAC is verified

No, the MAC is not encrypted per se, however, it is calculated in conjunction with a key (independent of the encryption key).

Simply encrypting your data ensures privacy, however, it doesn't ensure integrity (ie, that the ciphertext hasn't been tampered with since it was encrypted). Using a HMAC provides this integrity.

A simple hash function by itself is not sufficient, as an attacker could alter the ciphertext, calculate a new hash, append it to the new ciphertext, and you would be unable to detect any tampering. A HMAC solves this problem as it uses a key - meaning that an attacker is unable to create a valid HMAC unless they have a valid key (which only you possess).

You should note that if you plan to encrypt-then-HMAC, you not only need to calculate the MAC of the ciphertext, but also the IV ...ie, HMAC((ciphertext+IV), key)

You should also note that independent keys should be used for the encryption (AES, for example) and the authentication (HMAC). One approach is to use a masterkey, and then derive two separate keys using a KDF.

Of course, using an authenticated encryption mode such as GCM or EAX is less prone to implementation errors (assuming you're using a well-vetted library), and is recommended if you don't have much experience in crypto.

Answer 2

I'll answer your question in order of appearance:

1. HMAC can be used with any key size (as the key is basically used as input for the underlying hash function). If the key size is too small then the security of the HMAC is of affected. In general, the key size should be at least the output size of the hash algorithm divided by two. To comply with the security proofs on HMAC is would be even required to use the a separate key with the same size as the output of the hash function.

2. There is a lot of discussion if you should encrypt and then apply the MAC or the other way around. Encrypt-then-MAC is considered best practice by most. One of the reasons to use encrypt-then-MAC is the vulnerability of padding oracle attacks on the CBC mode of operation for encryption. To avoid these kind of plaintext oracle attacks you must verify the MAC value before decryption. HMAC itself does not use the AES algorithm in any way (the AES-CMAC algorithm does but that algorithm requires an additional key).

3. The AES cipher does normally not play a role in signing/verifying, unless it is used in a cipher based MAC algorithm such as the previously mentioned AES-CMAC algorithm.

4. Yes, it is correct that the AES ciphertext is HMAC-ed for signing and the HMAC is verified.

Answer 3

MAC (Message authentication code) is being used for message integrity and signatures for sender authenticity. That means that in an unauthenticated channel you need a way in order to be assured that the message received by Alice is coming actually from Alice (public signature) and the message has not being altered from an adversary(message integrity- MAC).

HMAC is one way in order to compute the MAC. Once you have encrypted with a secure block cipher as AES your data, THEN you MAC your data with your MAC key and you send AES(Data)+MAC(AES(DATA)). The order is important. First you must encrypt and then compute the MAC. If you don't do it this way there might be flaws. If you don't want to use this approach you can use a by construction authenticated mode of symmetric encryption