Imagine authentication like $hmac = H(nonce, ciphertext)$. $nonce$ is truly random and chosen (randomly and WITHOUT replacement) from predetermined set $N$. So ${nonce} \in N$ and once used cannot be reused ever again. And $N$ is publicly known. There is no algorithmic relationship between $nonce$ and $ciphertext$.

Is the HMAC secure given $N$ is public?

  • 1
    $\begingroup$ Given the nonce is chosen randomly, I would imagine it'll somehow be communicated -- in plain -- as part of the message / MAC tuple? Then surely an attacker able to intercept this communication can simply substitute their own message and recalculate the MAC using the communicated nonce. $\endgroup$
    – Morrolan
    Oct 31 '21 at 15:29
  • $\begingroup$ @Morrolan Hiya. Of course they can. But $N$ is a predetermined fixed set. " the communicated nonce" must be a member of $N$. And it can only be used once, and $|nonce|$ is very large. $\endgroup$
    – Paul Uszak
    Oct 31 '21 at 16:48
  • $\begingroup$ Yes, this question is hard to follow without proper description of the protocol for the interaction, like who chooses the nonce, what kind of set N is, and who calculates hmac and how it is communicated $\endgroup$ Nov 1 '21 at 4:20
  • $\begingroup$ @PaulUszak In this case it does seem to break down fully - being from a well-known set, and only being able to be used once, do not protect against an adversary able to intercept the message. They would modify it, recalculate the MAC and send the modified message on its way. If the nonce-to-be-used was chosen in some deterministic-but-secret (think PRF) way, then you could make it work. But of course then you need a shared secret key for the PRF. Maybe we're missing some point - might be worth it to reword / provide some more details. :) $\endgroup$
    – Morrolan
    Nov 1 '21 at 10:07
  • $\begingroup$ @Morrolan I'm looking for a One-time MAC. Apologies. $\endgroup$
    – Paul Uszak
    Nov 1 '21 at 13:23

If the nonce is known then HMAC is turned into a hash function, and an adversary can perform an active attack by simply replacing the authentication tag $t$ with $t' = H_{k=nonce}(ciphertext')$.

If a large $N$ is known or not doesn't matter; if the nonce remains secret then $N$ is simply the domain from which the secret is taken; i.e. in that case you've described a secret key generation function for which $N$ is generally known (e.g. it's $2^{256}$ for HMAC-SHA-256, general described as a function $\text{Gen}$ with output $1^{256}$ or $\{0, 1\}^{256}$).

Of course, as long as the tag value $t$ cannot be altered by the attacker then the construct is secure, assuming that $t$ is large enough. This is after all equivalent to having a static hash value for a specific message which cannot be altered, similar to a hash over a file on the original site which can be downloaded from a mirror.

Beware that this may not be the case for other MAC functions, e.g. you don't want to use GMAC with a known key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.