Linked Questions
19 questions linked to/from Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
0
votes
1
answer
975
views
Why is appending the key to a mesage and then hashing that insecure if the hash isn't weakly collision resistant? [duplicate]
Suppose I have H(M|K) and that H is not weakly collision resistant. If I have a message mac pair (M,MAC), how is it possible to find another message mac pair (M2,MAC2)? My thinking for this problem is ...
1
vote
0
answers
239
views
Secret key suffix vs HMAC [duplicate]
What is the benefit of using HMAC over hash with key suffix? I realize that using key prefix is a bad idea because it allows message extension attacks. When adding key as a suffix such attack ...
- 215
1
vote
1
answer
178
views
Can I use `SHA (message || key)` as MAC? [duplicate]
One should not use SHA for MAC, because knowing SHA(key || message) and message you can construct ...
- 11
1
vote
0
answers
136
views
Why don't we use H(m||k) as a MAC? [duplicate]
HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work.
Is there some other obvious attack?
- 1,101
26
votes
2
answers
7k
views
Is HMAC needed for a SHA-3 based MAC?
HMAC does nested hashing in order to prevent Length Extension Attacks.
Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
- 509
24
votes
2
answers
5k
views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mathbin\| x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k \...
17
votes
2
answers
8k
views
Why is h(m||k) insecure?
Here is the post that explains the failure for doing h(k||m) and I understand it.
But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain?
- 333
12
votes
1
answer
4k
views
Why is H(message||secret_key) not vulnerable to length-extension attack?
Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$.
Why can't he perform the same ...
- 123
2
votes
2
answers
1k
views
Using bcrypt for MAC - is it correct and secure?
Suppose there is a hashing function:
$$ph = bcrypt(sha256(m + k), salt)$$
Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
- 23
7
votes
2
answers
477
views
MAC where key is provided afterwards
I was just wondering if there is a MAC scheme where the key provided after part of the message has been hashed. I was just looking at TLS 1.3 and a comment of Thomas Pornin where the messages needed ...
- 94.5k
2
votes
1
answer
820
views
Is this DIY remote lock protocol secure?
I need your advice on following scheme of exchange protocol between remote lock and key. I'm planning to use following algorithm:
Key generates unique value that never repeats (in reality it's just ...
- 23
3
votes
2
answers
211
views
Strange MAC algorithm
I'm working with a payment provider which uses the following algorithm for signing messages:
The merchant is securely given a secret key k, known to them and the ...
- 225
1
vote
1
answer
1k
views
Symmetric mutual authentication with client using a derived secret
I'm attempting to find a client/server authentication protocol that allows the client and server to authenticate each other when the client doesn't know the server secret but does have a sensitive key ...
- 13
3
votes
2
answers
150
views
Strength of $H(k\|H(m))$ as a MAC algorithm
What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
- 3,705
1
vote
1
answer
773
views
Known text attack on Hash function (SHA 256 or SHA512)
I was thinking the below attack scenario on hash function. Let's assume that three binary numbers A(1000 bits), B(16 bits) and C(283 bits) are concatenated together and H(A||B||C) is generated using ...
- 37