Linked Questions

20
votes
3answers
3k views

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
29
votes
1answer
3k views

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\...
11
votes
1answer
381 views

Can Skein be used as a secure MAC in format H(k || m)?

Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
5
votes
2answers
3k views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
8
votes
2answers
975 views

Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
3
votes
1answer
2k views

HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

I'm looking at three options for shared-secret message authentication codes: HMAC-SHA-256(secret, payload) SHA-512/256(secret+payload) SHA-512(secret+payload) truncated to 256 bits Option 1 is the ...
0
votes
2answers
732 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
2
votes
1answer
483 views

SHA3 HMAC key padding

According to the pseudocode, keys longer than the block-size of the underlying hash function are shortened by hashing the key. Furthermore, keys shorter than the blocksize are zero-padded up the ...
5
votes
1answer
180 views

What is the collision resistance of a 2048-bit hash based on SHA-3?

Let $M$ denote the message. Let $B_i$ denote eight different bitstrings (chosen arbitrarily or randomly) such that $$0 \le \text{length}(B_i) \le 12345678.$$ Consider the following function (it ...
1
vote
1answer
63 views

Security implications of using hash as a MAC

What are the security risks, if I use a hash function $H$ such that $Y=H(K||M||N)$ where $K$ is a secret key, $M$ is a message, $N$ is a nonce and $||$ is concatenation operation (where the length of $...
4
votes
0answers
67 views

Do we still need HMAC now that SHA3 is here? [duplicate]

In Another look at HMAC from Koblitz and Menezes, they state that HMAC came along because doing h(secret || message) was vulnerable to length extension attacks. But as far as I know, these kind of ...