Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
563
questions
0
votes
1answer
111 views
Why is birthday attack invalid on this MAC
I am trying to understand why the following birthday attack is invalid for this MAC construction.
...
0
votes
0answers
16 views
Use HMAC for every block encryption operation [duplicate]
Is it possible to use HMAC while performing encryption of blocks?
I think that the main problem with the approach would be to get the same output size as the block, from the HMAC function.
Also, the ...
0
votes
1answer
65 views
Can a one time public key'd HMAC be secure?
Imagine authentication like $hmac = H(nonce, ciphertext)$. $nonce$ is truly random and chosen (randomly and WITHOUT replacement) from predetermined set $N$. So ${nonce} \in N$ and once used cannot be ...
0
votes
0answers
35 views
What is the difference between HMAC-SHA3-512 and KMAC? [duplicate]
Reading through the wikipedia entry for HMAC I see that SHA-3 can be used with the HMAC algorithm to give HMAC-SHA3-512.
I also know that there is KMAC, which from ...
0
votes
1answer
35 views
How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?
In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general.
I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
0
votes
1answer
87 views
is there any good attack model of HMAC?
are there any good attack models of HMAC ? like how it can be attacked ? if there are any possible attacks of HMAC i would be happy to know about it.
0
votes
0answers
63 views
What is the need of xor-ing the key with an outer and inner pad in HMAC?
The diagram above shows the standard HMAC algorithm. However
consider the algorithm of HMAC without xoring the key with outer or inner pad. In other words let the structure of HMAC remain the same ...
1
vote
1answer
44 views
Is the collision chance 2^(n/2) of an n-bit tag τ unchanged if reduced to (n/2)-bits using a reduction of τ to some 2^(n/2) order group element?
If $H(k, Μ) = τ$, in the context where $τ$ is an $n$-bit tag produced as a mac on a key, $k$, and a message, $M$, through a keyed-hash function, $H$, is there a function $F(τ) = T$ that transforms $τ$ ...
4
votes
1answer
302 views
Does hashing an ECB encryption with a strong hash function produce a secure MAC?
Does applying a strong hash function like SHA-256 to the ECB-encryption of a message (using some secret key $K$) produce a secure mac? For example, given a message $m$, would a simple mac construction ...
1
vote
1answer
54 views
HMAC key generation and encoding
I've this piece of .NET code that is based on a Microsoft sample on how to generate a key and sign using HMACSH256.
But I've altered the key generation a little bit and also decided to use Base64 to ...
0
votes
1answer
65 views
What authenticated encryption do kerberos use in windows?
I have learned about the kerberos protocol and seen that the windows version uses a couple of authenticated encryption schemas (like rc4-hmac-md5).
What type of authenticated encryption is it? Is it a:...
0
votes
1answer
42 views
Necessity of PBKDF2 in current Setup?
I have a single password which is random bytes that encrypts a database. Right now I am using an encryption scheme of https://gist.github.com/jbtule/4336842. To summarize, we take our one password, ...
2
votes
1answer
65 views
Can future time-based keys be deduced from a previous key?
If a time-based key generated by an authenticator app like Google Authenticator is compromised, can future keys be deduced from the compromised key?
0
votes
1answer
111 views
Does SHA384 make sense with HMAC-SHA256?
In the sense of security level (as defined, for example, by Ferguson and Schneier in the book Practical Cryptography), does it make sense to use SHA384 with HMAC-SHA256 in the general settings. By ...
0
votes
1answer
46 views
Use peppers with Bcrypt (HMAC + Bcrypt)
Is it useful to combine HMAC with Bcrypt ?
If it so, should I do the HMAC on the password before "Bcrypt"ing it ? or should I do the HMAC on the Bcrypt output ?
0
votes
0answers
37 views
Managing master keys used in PBKDF2 and HMAC (store, rotate)
My use case:
I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...).
I use these master keys in two specific ...
0
votes
0answers
20 views
HMAC vs hashing (data + pepper) [duplicate]
Is there a difference between HMAC and hashing (data + pepper) or both of them are equally secure ?
0
votes
1answer
58 views
AWS signature v4 key derivation
Generating Authorization header with AWS signature v4 involves deriving signing key as follows:
https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html
...
0
votes
1answer
32 views
Complexity of deriving message from CMAC vs HMAC when the key is known
From the description of CMAC and HMAC, given the key and the tag, I think it is easy to derive the CMAC message than the HMAC message.
After obtaining the key and tag for CMAC, an intruder can apply ...
0
votes
1answer
63 views
How to compose multiple values to MAC authenticate?
If the data I want to authenticate consists of multiple values and I compute a MAC simply concatenating the values, an adversary can "shift" characters within those values without ...
2
votes
0answers
36 views
Confused about encapsulation using different types of hash functions
I'm reading Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption. In Section 4 there is a description of encapsulation schemes that says
We suggest an encapsulation ...
0
votes
0answers
42 views
Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?
I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
2
votes
1answer
121 views
What does the running transcript hash in RFC-8446: TLS 1.3 do?
From RFC8446:
In general, implementations can implement the transcript by keeping a
running transcript hash value based on the negotiated hash. Note,
however, that subsequent post-handshake ...
2
votes
1answer
68 views
Question about IETF RFC6979 determinisitc (EC)DSA document section 3.6 additional data k'
In RFC6979, on page 14, Section 3.6 "Variants":
o. Additional data may be added to the input of HMAC, concatenated
after bits2octets(H(m)):
...
1
vote
0answers
87 views
What's the difference between H(m) $\oplus$ H(key) and H(m || key) in MAC construction?
We all know that HMAC has the form of $H(ikey || H(okey || M))$. I'm wondering what if we replace the H(okey || M) into H(okey) $\oplus$ H(M)? In other words, is $$H\Big( ikey \mathbin\| \big( H(okey) ...
0
votes
1answer
94 views
How to calculate a hmac and cmac
I'm searching for a simple description that tells me in a schematic way how hmac and cmac is calculated.
So far I found the following:
...
0
votes
0answers
21 views
Why doesn't appending a message to a key instead of vice versa defeat length extension attack? [duplicate]
It's well established that H(K||M) is vulnerable to length extension attacks for SHA-2 and other hashing algorithms, and instead an HMAC construction should be used. However - why can't H(M||K) be ...
1
vote
2answers
76 views
Is nonce-less Encrypt-then-HMAC as secure as poly1305
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
2
votes
0answers
92 views
Encrypt-then-HMAC with a single key is secure?
The partition oracle attacks exploits the non-committing AEAD schemes.
Informally, a committing encryption scheme is one for which it is computationally intractable to find a pair of keys and a ...
0
votes
0answers
255 views
Bitcoin Key Recovery Without Nonce Re-Use
There are a lot of questions in these forums regarding the recovery of private keys.
But I'm here to postulate on something unique to a specific piece of research that I looked into recently.
The ...
2
votes
1answer
384 views
Generating HMAC(SHA256) keys using WebCrypto deriveKey() API
I am using the javascript WebCrypto API window.crypto.subtle.deriveKey() API to generate HMAC keys like this:
...
1
vote
0answers
21 views
Is Poly1305 enough for cascading ciphers? [duplicate]
ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
0
votes
1answer
73 views
How do high hash rates affect hashed password security?
Given the increase in hash rate since the rise of numerous block chains, I wonder how this affects the security of many hashed password systems.
Is a standard linux ...
0
votes
0answers
43 views
Authentication tag length and post-quantum security
The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
0
votes
0answers
26 views
Randomizing output of HKDF for the same input key material [duplicate]
Given HKDF and a master input material key $k$, I would like to derive ephemeral keys that cannot be linked together. If I understand correctly, the specification of $HKDF$ adding a unique random $...
1
vote
1answer
148 views
HKDF Bit Security
I've always understood the bit security of hash functions to be related to their output size (eg. collision resistance). However, I recently came across a table from a Wickr blog post that lists HKDF-...
1
vote
0answers
80 views
Forgery of the Carter-Wegman MAC
Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
4
votes
1answer
580 views
Is HMAC-SHA256 a PRF?
In the abstract of The Exact PRF-Security of NMAC and HMAC, Gazi, Pietrzak, and Rybar state:
NMAC was introduced by Bellare, Canetti and Krawczyk [Crypto’96], who proved it to be a secure
...
4
votes
1answer
143 views
Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?
As we know, MD5 and SHA1 (to some extent) are broken, and older algorithms like SHA0 or MD4 and MD2 are very broken.
Does this also imply that the corresponding HMACs are also broken?
Obviously nobody ...
0
votes
0answers
58 views
How secure is Encrypt-And-MAC?
From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
2
votes
2answers
304 views
Is E_k(M)||H(m) form of MAC secure?
Would this encryption and signing scenario be considered tamper-proof?
...
1
vote
0answers
53 views
Schnorr Protocol Implementation - Sometimes Fails on Curve25519
I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
2
votes
1answer
125 views
AES-128/CTR/NoPadding HMAC vs Signature
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
-1
votes
1answer
57 views
Encryption on one AES mode and decrypting on another, where both use HMAC
Let's say there are 2 ciphers, $enc$ and $dec$, where:
$enc$ will encrypt the data, and $dec$ will decrypt it.
Both $enc$ and $dec$ must be an AES cipher.
$enc$ and $dec$ will use the same key $k$ ...
3
votes
2answers
184 views
How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?
I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
2
votes
1answer
81 views
HMAC256(K,m) vs HMAC256(K,K)
I have a key size of 128 bits. My message size is fairly short (e.g., 32 bits - and widely known). Although I am doing a SHA256, the result of the HMAC will be truncated to 128 bits.
So my question is:...
3
votes
0answers
84 views
Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?
HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function.
The hash functions considered in that paper were ones based on the Merkle-...
1
vote
1answer
107 views
byte significance with hash functions
I am using the python hmac module to generate an authentication code. Given a key, message, and hash function (I am using md5), the library returns an authentication code as a python bytes object. I ...
2
votes
1answer
60 views
Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)
Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability?
This is what I mean about doing MtEtM:
...
2
votes
0answers
58 views
How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?
I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them.
For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...