Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
0 votes
0 answers
62 views

HMAC-SHA256 key length against key recovery attack

I have trouble finding information on the security strength of HMAC-SHA256 against key recovery attacks with respect to the key size. To fit a certain application I must use a 128-bits key with a HMAC-...
dragonfire2000's user avatar
0 votes
1 answer
56 views

KangarooTwelve based Random-Access PRNG

Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
Ilan's user avatar
  • 1
1 vote
1 answer
80 views

Safe to use a BCrypt hash directly as a key to HMAC-SHA256?

Is it safe (or optimal) to use a BCrypt hash directly as the key to an HMAC-SHA256? I ask because all the BCrypt hashes I will use contain the same salt, version, and cost, so the first 29 characters ...
Starscream512's user avatar
0 votes
0 answers
49 views

Node.js generated JWT secret, nanoid() vs crypto.randomBytes() which is stronger

Which method will generate stronger secret? 64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: ...
wefad12292's user avatar
2 votes
1 answer
97 views

HMAC SHA256 walkthrough examples

I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully). I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc). Does anyone know of any ...
intrigued_66's user avatar
3 votes
1 answer
139 views

Does PBKDF2 HMAC 512 really only produce a maximum of ~128 bits of entropy? Regardless of input?

Andreas Antonopoulos effectively states: an input of 256bits of entropy into PBKDF2-HMAC-SHA512 will ONLY output a 64 byte hash containing ~128 bits of entropy. He states the algorithm essentially ...
George's user avatar
  • 33
3 votes
1 answer
135 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
3 votes
1 answer
89 views

Verify HMAC tag without knowing the key

Let's say there's Alice and Bob. Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$. Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
tock203's user avatar
  • 345
0 votes
1 answer
46 views

Why is IV in RFC8448 examples only 12 octets instead of 16?

I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
miran80's user avatar
  • 113
2 votes
1 answer
456 views

When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?

When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used), should we use SHA-...
SeekingAnswers's user avatar
1 vote
0 answers
63 views

Is there a multi-key HMAC scheme?

I wonder if there is any scheme or algorithm to generate HMACs that verify with multiple keys. Suppose I have the secret keys K1, K2 and K3 and I have a message M1. Is the following possible? ...
Different-March-5530's user avatar
2 votes
1 answer
90 views

Does having more than one HMAC provide more information to the attacker?

Suppose $N$ many messages has been sent from $A$ to $B$ in this format: $\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$. Where $C(i)$ is some cipher-text encrypted with some secure algorithm using ...
CuriousCrypto's user avatar
2 votes
2 answers
248 views

Why do we encrypt then decrypt then encrypt data with different keys?

In GlobalPlatform specification for smartcards, I came accross this rather strange scheme* ISO/IEC ISO/IEC 9797-1 MAC Algorithm 3: To calculate the Message Authentication Code, we take some original ...
Ryan B.'s user avatar
  • 153
1 vote
0 answers
128 views

Quantum-Safe MAC: HMAC and CMAC

If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
bilaljo's user avatar
  • 153
3 votes
1 answer
181 views

Security of using key size larger than the message digest size in HMAC, with one time pads

I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption. One time pads for the message and the key of HMAC are ...
CuriousCrypto's user avatar
-1 votes
1 answer
88 views

Can I use many iterations of HMAC function instead of PBKDF2?

I know, that PBKDF2 uses HMAC with SHA2 function as PRF. But.. can I use many iterations of HMAC with SHA2 directly? Is this effective and securely? P.S I need the best function, but I can’t use ...
Murrchalkina's user avatar
1 vote
0 answers
155 views

Is my TypeScript scrypt implementation using Web Crypto API safe and correct? (Open Source)

I want to use TweetNaCl.js for encrypting user data that is stored in LocalStorage. Therefore, I want to prompt the user to provide a PIN/password that shall be ...
kyr0's user avatar
  • 111
0 votes
0 answers
21 views

finding the Key if hmac output, and input are known [duplicate]

Assume we have message M, key K, and MAC = hmac-256SHA(M, K). I wonder if an attacker can figure out the Key K if the attacker knows the Message M and MAC
xin yao's user avatar
3 votes
1 answer
106 views

Signal's Key Wrap: is it safe and is it custom?

The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV. It's used to encrypt your master key with your ...
Tim Shadel's user avatar
0 votes
1 answer
52 views

Replace checksum with asymetric hash

The purpose is for a server to ensure the content of the flash memory of a slave IoT contains a good known firmware. The server does not have a copy of the IoT firmware code - but only a hash or ...
Adarwoo's user avatar
2 votes
1 answer
489 views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
LUMPAAK's user avatar
  • 21
1 vote
1 answer
77 views

Is there any point in extending an 80-bit key before using it for HMAC-SHA256?

I have been asked to make a HMAC-SHA256 password digest from: a password some salt, and an 80-bit secret key. I've been advised that I should be using a key of 256 bits or more for HMAC-256. The key ...
fadedbee's user avatar
  • 835
1 vote
0 answers
39 views

Zero-knowledge data storage with peace of mind. MAC/Encryption with two keys?

Background Bob's goal: Receive data E = E(D) (encryption of D) from Alice that he knows for sure is encrypted and that he can't possibly decrypt (without brute force). This gives his data backup ...
cryptonamus's user avatar
2 votes
1 answer
178 views

Generic attack on Hmac sha256

Is there any generic attack on HMAC SHA 256 ? I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
Donnie's user avatar
  • 33
-1 votes
2 answers
679 views

Can I 100% trust the PBKDF2(HMAC-SHA256) AES-256 CBC encryption algorithm for file encryption purposes or not, and why? (Winrar) [closed]

I am not an expert in cryptography and therefore I would like to address this problem to people who have been working on this topic for a long time and thus verify the facts from several sources. I ...
Hasbo's user avatar
  • 13
0 votes
1 answer
103 views

Is it insecure to make HMAC SHA1 message and corresponding hash public?

Not sure about the security implications of making HMAC SHA1 message and corresponding hash public (secret would remain… secret)? Evaluating if that would help an attacker crack algorithm.
sunknudsen's user avatar
0 votes
1 answer
1k views

Is HMAC SHA1 algorithm secure in 2022? [duplicate]

Contemplating using YubiKey’s challenge-response feature to hash public passphrases. By public, I mean an attacker could potentially exfiltrate passphrases but, not having YubiKey*, passphrases would ...
sunknudsen's user avatar
3 votes
1 answer
94 views

Avoid hash flooding without a secret key?

I'm currently building an implementation of the dynamo paper, yottastore. Imagine it as a huge, distributed, hash map. To find the node holding a key, I use rendezvous hashing (an improvement over ...
Mascarpone's user avatar
0 votes
1 answer
162 views

HMAC-MD5 or truncated HMAC-SHA512

I'm creating an application that requires message authentication on the payload of a QR-code. Because of the maximum length of an error-correcting (H) QR-code (368 bits) and the original size of my ...
Rien Bijl's user avatar
0 votes
0 answers
125 views

What is the minimum length of shortened HMAC to be considered safe?

Is it safe to truncate HMAC? What is the minimum length of a truncated HMAC so that HMAC is still considered to be safe to use? Are there any standards on when it comes to shortening HMAC? In my case, ...
g00dds's user avatar
  • 101
0 votes
0 answers
54 views

Is it safe to use CTR + HMAC with the same key when the key is unique for each message?

Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
g00dds's user avatar
  • 101
1 vote
0 answers
151 views

Is ChaCha20 + HMAC(SHA3) output indistinguishable from randomness?

I was wondering, if the output of following type of ChaCha + HMAC scheme is indistinguishable from randomness: ...
The amateur programmer's user avatar
2 votes
2 answers
304 views

How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
Kibnakamoto's user avatar
1 vote
0 answers
68 views

is HMAC required if i am using AES-CFB and using Digital signatures for Authentication

I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
ANISH M 18CS006's user avatar
3 votes
1 answer
418 views

NIST expression for HMAC security strength

In NIST SP800-107, NIST claims that the security strength of HMAC is MIN(security of HMAC key, $2L$). $L$ is the length of the output of the underlying hash function. Let's take HMAC-SHA256 as an ...
Evgeni Vaknin's user avatar
1 vote
1 answer
192 views

Can asymmetric encryption be used in HMAC, and still ensure the data has not been tampered with? [closed]

Suppose I want to send a message, but not privately; I want everybody to see it, even an attacker in the middle. I would do this by appending a public key to the start of the data, which could be used ...
jw01a's user avatar
  • 11
4 votes
2 answers
3k views

Is HMAC part of the TLS/SSL process?

Does HMAC take part in TLS/SSL? When the client and the server pass the TLS handshake and create a common SESSION key, do they also HMAC each message that is being sent out for the purpose of data ...
Aleksandar Stefanov's user avatar
1 vote
1 answer
161 views

Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?

Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
Paul Uszak's user avatar
1 vote
2 answers
288 views

Why does the RFC version of HKDF-Expand start the counter at 1?

In RFC 5869, the definition of HKDF-Expand is given as follows, with the terminating counter value ranging from 1 to (presumably) 255: ...
Neil Madden's user avatar
1 vote
1 answer
113 views

HMAC data and key swap

In some contexts (HKDF (RFC-5869 sec 2.2) and Bitcoin's BIP32 (master key generation)), I have seen the key and the data swapped for HMAC. E.g., let HMAC be a function $h:\{0,1\}^c \times \{0,1\}^b \...
zugzwang's user avatar
  • 119
0 votes
1 answer
55 views

Storing 4 char prefix for 32bit hex token after storing HMAC digest

Currently I am working on a public api that uses token authentication. The token is a 32 bit random hex that is shared with the user and then stored in our database as an HMAC digest using a secret ...
Joseph Carpenter's user avatar
0 votes
0 answers
197 views

Can a circuit in a zk-SNARK be reversed-engineered?

The definition of zk-SNARK involves not leaking any information from the prover-verifier interaction, but what about leaking information from the circuit itself? e.g., could there be a circuit to ...
nnsk's user avatar
  • 3
0 votes
0 answers
81 views

Is Using HMAC-SHA256(key, counter) For Providing Pad Only Vulnerable To Bruteforce?

...
whatamnotsaying's user avatar
0 votes
0 answers
30 views

Has reducing MAC size and increasing message size the same effect on security?

I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
Septatrix's user avatar
  • 101
1 vote
0 answers
124 views

Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?

The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
DodoDude700's user avatar
0 votes
1 answer
153 views

CTR HMAC SHA1 vs GCM Key management

The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1. For my thesis I want to research if GCM would be a better option. Therefore I read following discussion. There the answer was that GCM ...
Soteri's user avatar
  • 115
1 vote
1 answer
99 views

Where should MAC keys come from in a one time pad situation?

I refer to questions For a one-time pad, which MAC method is information-theoretically secure?, Seeking clarification of OTP & MAC discussion and this page illustrating various MACi. And the ...
Paul Uszak's user avatar
0 votes
1 answer
251 views

DIY: password key derivation tool using PBKDF2 / HMAC

First of all, I don't want to reinvent the wheel, just want to build my own car. Non-product environment; only for fun and entertainment. The goal is to use a single private (and never published) ...
swannty's user avatar
  • 381
6 votes
1 answer
663 views

HKDF randomness extraction - salt or no salt?

According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction. This question is solely about the necessity of a salt for the purposes of randomness ...
knaccc's user avatar
  • 4,672
4 votes
1 answer
476 views

Applications in which you should/shouldn't use a salt with HKDF

rfc5869 has the following to say about the use or lack thereof of salts with HKDF: HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
nohatsatthetable's user avatar

1
2 3 4 5
13