Linked Questions
13 questions linked to/from Why does HMAC use two different keys?
1
vote
0
answers
609
views
Why does HMAC use the hash twice? [duplicate]
According to the HMAC specification in RFC2104, an HMAC is computed in the following way:
HMAC(K, text) = H(K XOR opad, H(K XOR ipad, text))
where ...
2
votes
2
answers
484
views
Is there any good attack model of HMAC?
Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
- 21
1
vote
1
answer
769
views
is MAC double-hashing enough to prevent length extension attacks?
I know that
$$mac=\operatorname{SHA1}(secret\mathbin\|message)$$
is prone to length extension attacks, but what about:
$$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))?$$
In ...
- 507
1
vote
1
answer
131
views
OAEP security with variable length hash function
I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
- 189
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
- 213
6
votes
2
answers
1k
views
Proof that MAC and hash composition is insecure
Let $F$ be a secure PRF and $H$ a universal hash function.
How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$
is an insecure MAC (or an insecure PRF, since a ...
- 457
2
votes
0
answers
94
views
Is $H(k \operatorname\| H(k \operatorname\| m))$ with double length $k$ like NMAC? [duplicate]
I know that NMAC is mathematically proved with two different keys with length $L$.
But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of ...
- 21
4
votes
1
answer
165
views
Under which conditions would it be OK to use “H(pass||data)”?
I understand that the main motivation for HMAC is extension attacks. If data always has content-length either implicit in the app or even explicitly put into the hash, I get the impression that HMAC ...
- 349
8
votes
1
answer
217
views
Adding parameters to sponge's capacity
Is it safe to XOR parameters like domain, length of the message or block counter into sponge's capacity or that gives attacker control over capacity?
For example NORX XORs domain into capacity.
Does ...
- 1,649
9
votes
2
answers
2k
views
Keys in HMAC and NMAC
I'm quite new to this topic and have several questions concerning HMAC and NMAC:
Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
- 193
22
votes
4
answers
3k
views
Cycles in SHA-256
Let's say I start with a particular 256 bit value. Call this $v$. I then hash that value, and get another 256 bit value. Call this $\text{SHA256}(v)$. I take this value and get another 256 bit value. ...
- 323
35
votes
2
answers
16k
views
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme
Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme?
Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
- 1,496
26
votes
3
answers
10k
views
"Weaknesses" in SHA-256d?
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:
SHA-256d(x) = SHA-256(SHA-256(x))
Apparently, the motivation for ...
- 1,377