Linked Questions
14 questions linked to/from GMAC vs HMAC in message forgery and bandwidth
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
- 213
14
votes
2
answers
1k
views
Does GCM (or GHASH) only provide 64-bit security against forgeries?
In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
- 45.7k
13
votes
1
answer
6k
views
What are the rules for using AES-GCM correctly?
When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
- 611
10
votes
1
answer
622
views
how does BearSSL's GCM modular reduction work?
BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code:
...
- 2,895
9
votes
1
answer
2k
views
What are the constraints on using GCM with a tag size of 96 and 128 bits?
Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default).
NIST SP ...
- 91.7k
6
votes
2
answers
1k
views
Proof that MAC and hash composition is insecure
Let $F$ be a secure PRF and $H$ a universal hash function.
How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$
is an insecure MAC (or an insecure PRF, since a ...
- 447
7
votes
2
answers
2k
views
OCB and GCM security
Is OCB as secure as GCM or CCM ?
Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
- 2,837
3
votes
2
answers
2k
views
Difference between strongly universal and $\delta$ univeral hash functions
Define a family of strongly universal hash functions as:
$$\forall x_1, x_2 \in \{0,1\}^n, \forall y_1, y_2 \in \{0,1\}^m, ~ x_1\ne x_2: ~~ \Pr_{h\in H} [h(x_1) = y_1 ~\text{and}~ h(x_2) = y_2] \le \...
- 51
1
vote
2
answers
846
views
Does the AES-GCM specification require the tag-size to be bound to the GCM context?
Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)?
Asked differently, is the following a legitimate adherence to ...
- 43
4
votes
3
answers
669
views
What is the function of the secret key “r” in Poly1305?
Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
- 141
4
votes
1
answer
364
views
How does Gilbert, MacWilliams, and Sloane's solution to “perfect integrity” work?
Gilbert, MacWilliams, and Sloane defined a solution to "perfect integrity" in Codes Which Detect Deception, unconditionally secure message authentication, not vulnerable to any cryptanalysis on its ...
user73542
2
votes
1
answer
351
views
Does an information-theoretically secure hash function exist?
Does an information theoretically secure hash function exist? (By exist I mean is discovered/invented and implemented, not whether it could exist.)
- 516
1
vote
2
answers
153
views
Is this a better GCM?
Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
- 4,763
0
votes
1
answer
104
views
What's the proper way of fitting hash digest to encryption scheme?
I would like to know what is the proper way of fitting the hash digest to the prime in which the encryption scheme operates. regardless if the bits of the hash digest is larger or smaller than the ...
