Linked Questions

11 votes
2 answers
3k views

How many trials does it take to break HMAC-MD5?

I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
ladybug's user avatar
  • 213
14 votes
1 answer
6k views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
ams's user avatar
  • 631
14 votes
2 answers
2k views

Does GCM (or GHASH) only provide 64-bit security against forgeries?

In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
SEJPM's user avatar
  • 45.9k
10 votes
1 answer
640 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
neubert's user avatar
  • 2,917
9 votes
1 answer
2k views

What are the constraints on using GCM with a tag size of 96 and 128 bits?

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST SP ...
Maarten Bodewes's user avatar
  • 92.3k
6 votes
2 answers
1k views

Proof that MAC and hash composition is insecure

Let $F$ be a secure PRF and $H$ a universal hash function. How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$ is an insecure MAC (or an insecure PRF, since a ...
Daniel's user avatar
  • 457
7 votes
2 answers
2k views

OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
Dingo13's user avatar
  • 2,837
3 votes
2 answers
2k views

Difference between strongly universal and $\delta$ univeral hash functions

Define a family of strongly universal hash functions as: $$\forall x_1, x_2 \in \{0,1\}^n, \forall y_1, y_2 \in \{0,1\}^m, ~ x_1\ne x_2: ~~ \Pr_{h\in H} [h(x_1) = y_1 ~\text{and}~ h(x_2) = y_2] \le \...
csstundent's user avatar
1 vote
2 answers
948 views

Does the AES-GCM specification require the tag-size to be bound to the GCM context?

Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)? Asked differently, is the following a legitimate adherence to ...
Stan Drapkin's user avatar
4 votes
3 answers
677 views

What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
Jonathan's user avatar
  • 141
4 votes
1 answer
372 views

How does Gilbert, MacWilliams, and Sloane's solution to “perfect integrity” work?

Gilbert, MacWilliams, and Sloane defined a solution to "perfect integrity" in Codes Which Detect Deception, unconditionally secure message authentication, not vulnerable to any cryptanalysis on its ...
user avatar
2 votes
1 answer
368 views

Does an information-theoretically secure hash function exist?

Does an information theoretically secure hash function exist? (By exist I mean is discovered/invented and implemented, not whether it could exist.)
09182736471890's user avatar
1 vote
2 answers
156 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
Demi's user avatar
  • 4,793
0 votes
1 answer
104 views

What's the proper way of fitting hash digest to encryption scheme?

I would like to know what is the proper way of fitting the hash digest to the prime in which the encryption scheme operates. regardless if the bits of the hash digest is larger or smaller than the ...
Kelen Nihomori's user avatar