Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
618
questions
0
votes
0
answers
62
views
HMAC-SHA256 key length against key recovery attack
I have trouble finding information on the security strength of HMAC-SHA256 against key recovery attacks with respect to the key size.
To fit a certain application I must use a 128-bits key with a HMAC-...
0
votes
1
answer
56
views
KangarooTwelve based Random-Access PRNG
Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
- 1
1
vote
1
answer
80
views
Safe to use a BCrypt hash directly as a key to HMAC-SHA256?
Is it safe (or optimal) to use a BCrypt hash directly as the key to an HMAC-SHA256? I ask because all the BCrypt hashes I will use contain the same salt, version, and cost, so the first 29 characters ...
0
votes
0
answers
49
views
Node.js generated JWT secret, nanoid() vs crypto.randomBytes() which is stronger
Which method will generate stronger secret?
64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: ...
2
votes
1
answer
97
views
HMAC SHA256 walkthrough examples
I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully).
I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc).
Does anyone know of any ...
- 123
3
votes
1
answer
139
views
Does PBKDF2 HMAC 512 really only produce a maximum of ~128 bits of entropy? Regardless of input?
Andreas Antonopoulos effectively states: an input of 256bits of entropy into PBKDF2-HMAC-SHA512 will ONLY output a 64 byte hash containing ~128 bits of entropy. He states the algorithm essentially ...
- 33
3
votes
1
answer
135
views
Does HMAC provide anything that AES GCM does not?
I would like to let the receiver has the ability to check the sender's authenticity when he gets the message.
Also, I want to protect the message's confidentiality and integrity.
Should I use ...
- 43
3
votes
1
answer
89
views
Verify HMAC tag without knowing the key
Let's say there's Alice and Bob.
Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$.
Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
- 345
0
votes
1
answer
46
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
- 113
2
votes
1
answer
456
views
When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?
When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used),
should we use SHA-...
1
vote
0
answers
63
views
Is there a multi-key HMAC scheme?
I wonder if there is any scheme or algorithm to generate HMACs that verify with multiple keys.
Suppose I have the secret keys K1, K2 and K3 and I have a message M1. Is the following possible?
...
2
votes
1
answer
90
views
Does having more than one HMAC provide more information to the attacker?
Suppose $N$ many messages has been sent from $A$ to $B$ in this format:
$\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$.
Where
$C(i)$ is some cipher-text encrypted with some secure algorithm using ...
2
votes
2
answers
248
views
Why do we encrypt then decrypt then encrypt data with different keys?
In GlobalPlatform specification for smartcards, I came accross this rather strange scheme* ISO/IEC ISO/IEC 9797-1 MAC Algorithm 3:
To calculate the Message Authentication Code, we take some original ...
- 153
1
vote
0
answers
128
views
Quantum-Safe MAC: HMAC and CMAC
If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
- 153
3
votes
1
answer
181
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
-1
votes
1
answer
88
views
Can I use many iterations of HMAC function instead of PBKDF2?
I know, that PBKDF2 uses HMAC with SHA2 function as PRF. But.. can I use many iterations of HMAC with SHA2 directly? Is this effective and securely? P.S I need the best function, but I can’t use ...
- 11
1
vote
0
answers
155
views
Is my TypeScript scrypt implementation using Web Crypto API safe and correct? (Open Source)
I want to use TweetNaCl.js for encrypting user data that is stored in LocalStorage. Therefore, I want to prompt the user to provide a PIN/password that shall be ...
- 111
0
votes
0
answers
21
views
finding the Key if hmac output, and input are known [duplicate]
Assume we have message M, key K, and MAC = hmac-256SHA(M, K).
I wonder if an attacker can figure out the Key K if the attacker knows the Message M and MAC
- 1
3
votes
1
answer
106
views
Signal's Key Wrap: is it safe and is it custom?
The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV.
It's used to encrypt your master key with your ...
- 161
0
votes
1
answer
52
views
Replace checksum with asymetric hash
The purpose is for a server to ensure the content of the flash memory of a slave IoT contains a good known firmware.
The server does not have a copy of the IoT firmware code - but only a hash or ...
- 1
2
votes
1
answer
489
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 21
1
vote
1
answer
77
views
Is there any point in extending an 80-bit key before using it for HMAC-SHA256?
I have been asked to make a HMAC-SHA256 password digest from:
a password
some salt, and
an 80-bit secret key.
I've been advised that I should be using a key of 256 bits or more for HMAC-256.
The key ...
- 835
1
vote
0
answers
39
views
Zero-knowledge data storage with peace of mind. MAC/Encryption with two keys?
Background
Bob's goal: Receive data E = E(D) (encryption of D) from Alice that he knows for sure is encrypted and that he can't possibly decrypt (without brute force). This gives his data backup ...
- 233
2
votes
1
answer
178
views
Generic attack on Hmac sha256
Is there any generic attack on HMAC SHA 256 ?
I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
- 33
-1
votes
2
answers
679
views
Can I 100% trust the PBKDF2(HMAC-SHA256) AES-256 CBC encryption algorithm for file encryption purposes or not, and why? (Winrar) [closed]
I am not an expert in cryptography and therefore I would like to address this problem to people who have been working on this topic for a long time and thus verify the facts from several sources.
I ...
- 13
0
votes
1
answer
103
views
Is it insecure to make HMAC SHA1 message and corresponding hash public?
Not sure about the security implications of making HMAC SHA1 message and corresponding hash public (secret would remain… secret)?
Evaluating if that would help an attacker crack algorithm.
- 189
0
votes
1
answer
1k
views
Is HMAC SHA1 algorithm secure in 2022? [duplicate]
Contemplating using YubiKey’s challenge-response feature to hash public passphrases.
By public, I mean an attacker could potentially exfiltrate passphrases but, not having YubiKey*, passphrases would ...
- 189
3
votes
1
answer
94
views
Avoid hash flooding without a secret key?
I'm currently building an implementation of the dynamo paper, yottastore. Imagine it as a huge, distributed, hash map.
To find the node holding a key, I use rendezvous hashing (an improvement over ...
- 133
0
votes
1
answer
162
views
HMAC-MD5 or truncated HMAC-SHA512
I'm creating an application that requires message authentication on the payload of a QR-code. Because of the maximum length of an error-correcting (H) QR-code (368 bits) and the original size of my ...
0
votes
0
answers
125
views
What is the minimum length of shortened HMAC to be considered safe?
Is it safe to truncate HMAC? What is the minimum length of a truncated HMAC so that HMAC is still considered to be safe to use? Are there any standards on when it comes to shortening HMAC?
In my case, ...
- 101
0
votes
0
answers
54
views
Is it safe to use CTR + HMAC with the same key when the key is unique for each message?
Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
- 101
1
vote
0
answers
151
views
Is ChaCha20 + HMAC(SHA3) output indistinguishable from randomness?
I was wondering, if the output of following type of ChaCha + HMAC scheme is indistinguishable from randomness:
...
2
votes
2
answers
304
views
How does the ECIES-AES encryption work with a key size that is not supported by AES?
I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
- 43
1
vote
0
answers
68
views
is HMAC required if i am using AES-CFB and using Digital signatures for Authentication
I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
3
votes
1
answer
418
views
NIST expression for HMAC security strength
In NIST SP800-107, NIST claims that the security strength of HMAC is MIN(security of HMAC key, $2L$). $L$ is the length of the output of the underlying hash function. Let's take HMAC-SHA256 as an ...
- 1,066
1
vote
1
answer
192
views
Can asymmetric encryption be used in HMAC, and still ensure the data has not been tampered with? [closed]
Suppose I want to send a message, but not privately; I want everybody to see it, even an attacker in the middle. I would do this by appending a public key to the start of the data, which could be used ...
- 11
4
votes
2
answers
3k
views
Is HMAC part of the TLS/SSL process?
Does HMAC take part in TLS/SSL? When the client and the server pass the TLS handshake and create a common SESSION key, do they also HMAC each message that is being sent out for the purpose of data ...
1
vote
1
answer
161
views
Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?
Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
- 15k
1
vote
2
answers
288
views
Why does the RFC version of HKDF-Expand start the counter at 1?
In RFC 5869, the definition of HKDF-Expand is given as follows, with the terminating counter value ranging from 1 to (presumably) 255:
...
- 547
1
vote
1
answer
113
views
HMAC data and key swap
In some contexts (HKDF (RFC-5869 sec 2.2) and Bitcoin's BIP32 (master key generation)), I have seen the key and the data swapped for HMAC. E.g., let HMAC be a function $h:\{0,1\}^c \times \{0,1\}^b \...
- 119
0
votes
1
answer
55
views
Storing 4 char prefix for 32bit hex token after storing HMAC digest
Currently I am working on a public api that uses token authentication. The token is a 32 bit random hex that is shared with the user and then stored in our database as an HMAC digest using a secret ...
0
votes
0
answers
197
views
Can a circuit in a zk-SNARK be reversed-engineered?
The definition of zk-SNARK involves not leaking any information from the prover-verifier interaction, but what about leaking information from the circuit itself? e.g., could there be a circuit to ...
- 3
0
votes
0
answers
81
views
0
votes
0
answers
30
views
Has reducing MAC size and increasing message size the same effect on security?
I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
- 101
1
vote
0
answers
124
views
Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?
The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
- 111
0
votes
1
answer
153
views
CTR HMAC SHA1 vs GCM Key management
The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1.
For my thesis I want to research if GCM would be a better option.
Therefore I read following discussion.
There the answer was that GCM ...
- 115
1
vote
1
answer
99
views
Where should MAC keys come from in a one time pad situation?
I refer to questions For a one-time pad, which MAC method is information-theoretically secure?, Seeking clarification of OTP & MAC discussion and this page illustrating various MACi. And the ...
- 15k
0
votes
1
answer
251
views
DIY: password key derivation tool using PBKDF2 / HMAC
First of all, I don't want to reinvent the wheel, just want to build my own car. Non-product environment; only for fun and entertainment.
The goal is to use a single private (and never published) ...
- 381
6
votes
1
answer
663
views
HKDF randomness extraction - salt or no salt?
According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction.
This question is solely about the necessity of a salt for the purposes of randomness ...
- 4,672
4
votes
1
answer
476
views
Applications in which you should/shouldn't use a salt with HKDF
rfc5869 has the following to say about the use or lack thereof of salts with HKDF:
HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
