0
$\begingroup$

Which HMAC scheme is more secure? Or are they of the same level of security?

Scheme One

  • Compute a HMAC on the data to encrypt (cleartext/plaintext)

  • Encrypt the data with AES_CTR_256, and append above HMAC to end of ciphertext

Scheme Two

  • Compute a HMAC on the data to encrypt (cleartext/plaintext)

  • Encrypt the data with AES_CTR_256, and append above HMAC to end of ciphertext

  • Compute another HMAC on the ciphertext_HMAC combo and append it; ciphertext_HMAC_HMAC

And also, would using the same HMAC key be secure for scheme two?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
2
$\begingroup$

The first scheme is similar to what's called Encrypt-and-MAC. It is not ideal, but it is not fatally broken, and it is still used by the SSH protocol securely. You need to include a counter or other unique value in the data being MACed to maintain IND-CPA security (i.e. identical plaintexts don't have identical MACs).

The second scheme you present doesn't really make sense. I can't see what benefit it would provide. Generally, you would want to use Encrypt-then-MAC, or EtM, a scheme where the plaintext is encrypted, the MAC is computed over the ciphertext and appended directly to it. EtM is a better scheme because it gives away no information about the plaintext, even if the MAC is broken. It also gives you the benefit of allowing you to discard a forged message without needing to decrypt it first, to prevent some attacks.

See also Should we MAC-then-encrypt or encrypt-then-MAC?

On a side-note, you should use AEAD instead. For AES, that means selecting an authenticated mode like GCM, which is both fast and secure. Although HMAC can be used safely, AEAD is usually better.

Improve this answer
$\endgroup$
8
  • $\begingroup$ Thanks for the answer - exactly what I was looking for. Out of curiosity, is the first scheme in the linked question (TLS scheme) safer than the one you describe in your answer? $\endgroup$
    – Legorooj
    Sep 9, 2019 at 6:59
  • 1
    $\begingroup$ @Legorooj No. Encrypt-then-MAC is better than MAC-then-Encrypt (see answers to the linked question). Note that TLS 1.3 doesn't use HMAC anyway. It uses AES in GCM mode (but CCM is also supported). $\endgroup$
    – forest ♦
    Sep 9, 2019 at 7:00
  • $\begingroup$ Thanks, this solves my question. :-) $\endgroup$
    – Legorooj
    Sep 9, 2019 at 7:01
  • 1
    $\begingroup$ To be clear: Encrypt-and-mac using a deterministic MAC like HMAC is fatally broken in the sense that it breaks CPA security because it leaks equality of plaintexts. $\endgroup$
    – Maeher
    Sep 9, 2019 at 7:10
  • $\begingroup$ @Maeher Well that's why you need to use a random HMAC key. $\endgroup$
    – forest ♦
    Sep 9, 2019 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.