1
$\begingroup$

I need to check integrity of high secure system value - in this case encryption key(s)

I would like to create HMAC digest of this user encryption key (key is used in application as a key for AES-256 cipher) to check it's integrity. The encryption key is derived with a KDF from his password and salt, after every user's login into the application. After user registration, I create an integrity HMAC-SHA256 digest for user's encryption key. This digest IMHO shouldn't be kept secret and will be saved with other user data. While user is logging in, I create digest and compare it with saved value of the digest. If both of digests are same, integrity is approved.

-This makes me ask: Is it required to keep keys used for HMAC-SHA256 secured or can I leave it with other user data (non-secure, "in the open")? When a hypothetical opponent gets the key, is it possible for the opponent to restore the original value of an encryption key from a HMAC-SHA256 digest?

Edit

I'm not sure, because I'm thinking; when an opponent doesn't know the "secret value" (application encryption key), the opponent is not able to create the same digest, even if he knows the HMAC-SHA256 key. Is that a correct assumption?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

My question: Is required to keep a key for HMAC-SHA256 secured or can I leave it with other user data as non-secure?

If your goal is integrity and you use a HMAC, then it is mandatory to keep the key secret. A public key in HMAC would mean anyone can create valid tags for any message - and integrity is gone.

When hypothetical opponent gets the key, is it possible from HMAC-SHA256 digest restore original encryption key?

No, it should be impossible to find the key from any HMAC value (that would contradict the security definition).

Improve this answer
$\endgroup$
7
  • $\begingroup$ Just for clarification, maybe I'm not totally clear - I am asking if is mandatory to keep secret key for HMAC-SHA256 (and not an "encryption key" from application). $\endgroup$
    – jnemecz
    Commented Jun 9, 2017 at 10:33
  • $\begingroup$ That is exactly what I meant. There are only two cases: Either the secret value in HMAC (which we can call key) has to be secret or it doesn't. If it is not secret, there is no integrity. By Kerckhoff's theorem, the attacker knows everything except the key. $\endgroup$
    – tylo
    Commented Jun 9, 2017 at 10:47
  • $\begingroup$ I think I understand. One more question - final digest created by HMAC-SHA256 is public knowledge, isn't it? $\endgroup$
    – jnemecz
    Commented Jun 9, 2017 at 10:59
  • $\begingroup$ Yes. That's the whole point. If you have some integrity verification which is entirely hidden, then you don't need HMAC. If you think about message integrity, HMAC is part of the message and usually not encrypted - see this question (that's called encrypt-then-mac) $\endgroup$
    – tylo
    Commented Jun 9, 2017 at 11:28
  • $\begingroup$ @tylo I believe you are using the word integrity instead of authenticity, there. $\endgroup$
    – Lery
    Commented Jun 13, 2017 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.