10 questions linked to/from Why does HMAC use two different keys?
86 views

Is $H(k \operatorname\| H(k \operatorname\| m))$​ with double length $k$ like NMAC? [duplicate]

I know that NMAC is mathematically proved with two different keys with length $L$. But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of ...
12k views

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme

Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
2k views

Cycles in SHA-256

Let's say I start with a particular 256 bit value. Call this $v$. I then hash that value, and get another 256 bit value. Call this $\text{SHA256}(v)$. I take this value and get another 256 bit value. ...
7k views

“Weaknesses” in SHA-256d?

According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so: SHA-256d(x) = SHA-256(SHA-256(x)) Apparently, the motivation for ...
2k views

How many trials does it take to break HMAC-MD5?

I know that you can find collision in MD5 with 2^64 trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I ...
1k views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
455 views

Proof that MAC and hash composition is insecure

Let $F$ be a secure PRF and $H$ a universal hash function. How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$ is an insecure MAC (or an insecure PRF, since a ...
113 views

Under which conditions would it be OK to use “H(pass||data)”?

I understand that the main motivation for HMAC is extension attacks. If data always has content-length either implicit in the app or even explicitly put into the hash, I get the impression that HMAC ...