Given: an AES-128 secret key (ASecKey) encrypts a file (CBC mode). (Assume good random)

Is is insecure to append (include) an HMAC-SHA1 of ASecKey to file?

Purpose: The receiver can then quickly verify if the shared secret key was used to encrypt.

  • 3
    $\begingroup$ What key is used to compute the HMAC? $\endgroup$
    – yyyyyyy
    Jun 28, 2015 at 21:29
  • $\begingroup$ Same key. That is: ASecKey encrypts file and ASecKey is used to compute HMAC $\endgroup$
    – cary melz
    Jun 29, 2015 at 14:14
  • $\begingroup$ ASecKey is used to compute HMAC of what? I.e. what are the key and message to HMAC? $\endgroup$
    – otus
    Jun 30, 2015 at 14:00

2 Answers 2


It's probably better to use a KBKDF as that doesn't need a key as input. You can use the KDF as key check value or KCV. If you use a block cipher based KBKDF from NIST SP 800-108 then you could reuse the AES algorithm to calculate the KCV.

You could however also make it easy for yourself and use a SHA-1 or SHA-2 over the key as KCV.

Note that the PKCS#11 method allows for calculating a KCV by encrypting a block of all zero's; this method should not be used.

  • $\begingroup$ Please note my question here though. $\endgroup$
    – Maarten Bodewes
    Jun 28, 2015 at 23:58
  • $\begingroup$ Thank you Marten. I don't understand why it's better to use a KBKDF that doesn't use a key $\endgroup$
    – cary melz
    Jul 6, 2015 at 18:47
  • $\begingroup$ Well, you say that you want to use HMAC, but in that case you would require a key and data. Now you could use the key and pre defined data, but that's a bit of a kludge. With a KDF you could just use the key as seed. $\endgroup$
    – Maarten Bodewes
    Jul 6, 2015 at 20:06
  • $\begingroup$ So HMAC (key, data) where key=data is not insecure, it's just not needed. SHAing the key does not imply loss of any pre -Image resistance. Thank you, again. $\endgroup$
    – cary melz
    Jul 6, 2015 at 20:50

To setup HMAC, you need a key. This key should be derived from ASecKey, for example by using HKDF. As input for HKDF, you supply Salt (does not have to be secret) + ASecKey. Then you generate entropy with HKDF (e.g. extract PRK and expand it). Use this entropy to obtain HMAC key. Then you can attach HMAC output to your file. When receiver wants to decrypt file, she supplies ASecKey, which is used to decrypt message and initialize HMAC. Without ASecKey, an attacker can't determine what key is used for HMAC. With HMAC, you can verify integrity of the encrypted message (you should encrypt, then HMAC). If you want to check whether supplied ASecKey is correct, you can use some of the HKDF output I described before as password validator sequence, which you attach to the file and check on decryption.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.