Linked Questions
10 questions linked to/from Why is h(m||k) insecure?
2
votes
0answers
50 views
Will length-extension work if secret is not prefixed but appended to the data? [duplicate]
Possible Duplicate:
Why is h(m||k) insecure?
Length-extension allows to append any data to the message while not knowing the secret. Any length-extension explaination one the web considers the ...
50
votes
2answers
15k views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
22
votes
4answers
4k views
Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
9
votes
4answers
516 views
Using hashes as passwords
I have thought of a system for generating passwords which works as follows:
Take the following items:
A password, such as williamwallace.
A secret 1000 digit ...
1
vote
3answers
638 views
Understanding MACs and why cleartext is sent over
Assume both Alice and Bob have a symmetrical key, let's call it $k$.
They agree on a cryptographic hash function, let's call it $\mathsf{HASH}$.
Now Alice wants to send an authenticated message.
She ...
5
votes
2answers
1k views
Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?
Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
2
votes
1answer
2k views
Reversing SHA1 (don't know the correct term)
Given sha1(pad(A) || pad(B)), where B is known, can I calculate sha1(pad(A))? pad(A) means its length is exactly 1 block (64 bytes for SHA-1)
If yes, for which other hash functions it will work too?
...
-3
votes
1answer
161 views
cipherText = aes-ctr(key, iv+1, (plainText)); & authTag= aes-ctr(key, iv, aes-ecb(key, sha-1(cipherText+authData+key+iv))); is it secure? [closed]
Proposed Cipher suite (using aes-ecb):
...
2
votes
1answer
66 views
Constant data as input to hash
I want to use hash function on some data, and part of this data, might be constant for a certain period. The output of the hash function is used as authentication data (MAC).
I want to know if there ...
1
vote
0answers
104 views
Secret key suffix vs HMAC [duplicate]
What is the benefit of using HMAC over hash with key suffix? I realize that using key prefix is a bad idea because it allows message extension attacks. When adding key as a suffix such attack ...