Linked Questions
13 questions linked to/from Why does HMAC use two different keys?
2
votes
0
answers
93
views
Is $H(k \operatorname\| H(k \operatorname\| m))$ with double length $k$ like NMAC? [duplicate]
I know that NMAC is mathematically proved with two different keys with length $L$.
But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of ...
- 21
22
votes
4
answers
3k
views
Cycles in SHA-256
Let's say I start with a particular 256 bit value. Call this $v$. I then hash that value, and get another 256 bit value. Call this $\text{SHA256}(v)$. I take this value and get another 256 bit value. ...
- 323
34
votes
2
answers
16k
views
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme
Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme?
Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
- 1,486
26
votes
3
answers
10k
views
"Weaknesses" in SHA-256d?
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:
SHA-256d(x) = SHA-256(SHA-256(x))
Apparently, the motivation for ...
- 1,378
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
- 213
9
votes
2
answers
2k
views
Keys in HMAC and NMAC
I'm quite new to this topic and have several questions concerning HMAC and NMAC:
Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
- 193
6
votes
2
answers
1k
views
Proof that MAC and hash composition is insecure
Let $F$ be a secure PRF and $H$ a universal hash function.
How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$
is an insecure MAC (or an insecure PRF, since a ...
- 447
2
votes
2
answers
435
views
Is there any good attack model of HMAC?
Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
- 21
1
vote
1
answer
676
views
is MAC double-hashing enough to prevent length extension attacks?
I know that
$$mac=\operatorname{SHA1}(secret\mathbin\|message)$$
is prone to length extension attacks, but what about:
$$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))?$$
In ...
- 487
8
votes
1
answer
212
views
Adding parameters to sponge's capacity
Is it safe to XOR parameters like domain, length of the message or block counter into sponge's capacity or that gives attacker control over capacity?
For example NORX XORs domain into capacity.
Does ...
- 1,649
4
votes
1
answer
162
views
Under which conditions would it be OK to use “H(pass||data)”?
I understand that the main motivation for HMAC is extension attacks. If data always has content-length either implicit in the app or even explicitly put into the hash, I get the impression that HMAC ...
- 349
1
vote
0
answers
523
views
Why does HMAC use the hash twice? [duplicate]
According to the HMAC specification in RFC2104, an HMAC is computed in the following way:
HMAC(K, text) = H(K XOR opad, H(K XOR ipad, text))
where ...
1
vote
1
answer
131
views
OAEP security with variable length hash function
I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
- 189