Linked Questions

26 votes
4 answers

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
fgrieu's user avatar
  • 142k
30 votes
1 answer

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\...
fgrieu's user avatar
  • 142k
11 votes
1 answer

Can Skein be used as a secure MAC in format H(k || m)?

Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
user13183's user avatar
  • 145
8 votes
2 answers

Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
Anon2000's user avatar
  • 341
7 votes
2 answers

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
otus's user avatar
  • 32.1k
3 votes
1 answer

HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

I'm looking at three options for shared-secret message authentication codes: HMAC-SHA-256(secret, payload) SHA-512/256(secret+payload) SHA-512(secret+payload) truncated to 256 bits Option 1 is the ...
Kannan Goundan's user avatar
0 votes
2 answers

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
aobocod's user avatar
0 votes
1 answer

Are RSA-SHA256 signatures prone to length extension attacks?

I need to sign a message using a private key and verify the message with a public key, while making sure the message hasn’t been tampered. I know that SHA-256 itself is prone to length-extension ...
vdavid's user avatar
  • 103
2 votes
1 answer

SHA3 HMAC key padding

According to the pseudocode, keys longer than the block-size of the underlying hash function are shortened by hashing the key. Furthermore, keys shorter than the blocksize are zero-padded up the ...
hunter's user avatar
  • 3,975
5 votes
1 answer

What is the collision resistance of a 2048-bit hash based on SHA-3?

Let $M$ denote the message. Let $B_i$ denote eight different bitstrings (chosen arbitrarily or randomly) such that $$0 \le \text{length}(B_i) \le 12345678.$$ Consider the following function (it ...
lyrically wicked's user avatar
1 vote
1 answer

Security implications of using hash as a MAC

What are the security risks, if I use a hash function $H$ such that $Y=H(K||M||N)$ where $K$ is a secret key, $M$ is a message, $N$ is a nonce and $||$ is concatenation operation (where the length of $...
prosaad's user avatar
  • 93
4 votes
0 answers

Do we still need HMAC now that SHA3 is here? [duplicate]

In Another look at HMAC from Koblitz and Menezes, they state that HMAC came along because doing h(secret || message) was vulnerable to length extension attacks. But as far as I know, these kind of ...
David 天宇 Wong's user avatar