Linked Questions

10
votes
1answer
1k views

Why does HMAC use two different keys?

Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
8
votes
1answer
8k views

What is a universal hash function?

Short and to the point. I'm assuming that it is not a kind of hash function that can be used universally. After having read about universal hash functions used with the one-time pad to form an ...
5
votes
2answers
1k views

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that: The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
5
votes
3answers
529 views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
4
votes
1answer
813 views

Is there are a metric based on collisions to compare bad hash functions?

Bad hash functions are not so perfect as in the "general collision probability" hypothesis... And a general concept of "collision resistence" not need the constraint of independence between the ...
0
votes
1answer
438 views

How to use cryptography to assure data integrity?

I only understand assurance of integrity using a hash function. How to use cryptograpy to assure data integrity?
2
votes
1answer
790 views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...
0
votes
1answer
472 views

What is a fast good-uniformity hash function that if it's seed and it's hash values are unknown, can be strong as cryptographic hash functions?

The hash function is for an application that the input to the hash function is from a user's, hence the user can control the collisions, but the question is that if the collisions, the hash function's ...
2
votes
1answer
180 views

Why is a one-time MAC secure for MAC-then-encrypt with randomized-CTR but not randomized-CBC?

The Coursera cryptography 1 course says: If you want to use MAC-then-encrypt mode then you should either use randomized-CTR or randomized-CBC. And if you use randomized-CTR then one-time-MAC ...
3
votes
1answer
173 views

Can an attacker recover the key if a Poly1305 collision is known?

Suppose that messages $m_1$ and $m_2 \neq m_1$, both known to the attacker, are both MAC'd through Poly1305 with the same key. By chance, these two messages hash to the same value. The attacker ...
1
vote
1answer
120 views

are there more efficient methods than HMAC to achieve convergent encryption?

I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...