Linked Questions

2 votes
0 answers

Is $H(k \operatorname\| H(k \operatorname\| m))$​ with double length $k$ like NMAC? [duplicate]

I know that NMAC is mathematically proved with two different keys with length $L$. But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of ...
Abmen's user avatar
  • 21
22 votes
4 answers

Cycles in SHA-256

Let's say I start with a particular 256 bit value. Call this $v$. I then hash that value, and get another 256 bit value. Call this $\text{SHA256}(v)$. I take this value and get another 256 bit value. ...
bnsh's user avatar
  • 323
34 votes
2 answers

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme

Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
Rook's user avatar
  • 1,486
26 votes
3 answers

"Weaknesses" in SHA-256d?

According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so: SHA-256d(x) = SHA-256(SHA-256(x)) Apparently, the motivation for ...
Nemo's user avatar
  • 1,378
11 votes
2 answers

How many trials does it take to break HMAC-MD5?

I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
ladybug's user avatar
  • 213
9 votes
2 answers

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
user3142067's user avatar
6 votes
2 answers

Proof that MAC and hash composition is insecure

Let $F$ be a secure PRF and $H$ a universal hash function. How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$ is an insecure MAC (or an insecure PRF, since a ...
Daniel's user avatar
  • 447
2 votes
2 answers

Is there any good attack model of HMAC?

Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
malik bilal's user avatar
1 vote
1 answer

is MAC double-hashing enough to prevent length extension attacks?

I know that $$mac=\operatorname{SHA1}(secret\mathbin\|message)$$ is prone to length extension attacks, but what about: $$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))?$$ In ...
hanshenrik's user avatar
8 votes
1 answer

Adding parameters to sponge's capacity

Is it safe to XOR parameters like domain, length of the message or block counter into sponge's capacity or that gives attacker control over capacity? For example NORX XORs domain into capacity. Does ...
LightBit's user avatar
  • 1,649
4 votes
1 answer

Under which conditions would it be OK to use “H(pass||data)”?

I understand that the main motivation for HMAC is extension attacks. If data always has content-length either implicit in the app or even explicitly put into the hash, I get the impression that HMAC ...
Rob's user avatar
  • 349
1 vote
0 answers

Why does HMAC use the hash twice? [duplicate]

According to the HMAC specification in RFC2104, an HMAC is computed in the following way: HMAC(K, text) = H(K XOR opad, H(K XOR ipad, text)) where ...
Fabian Schmitthenner's user avatar
1 vote
1 answer

OAEP security with variable length hash function

I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
ThePlasmaRailgun's user avatar