Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
543
questions
2
votes
0answers
32 views
Confused about encapsulation using different types of hash functions
I'm reading Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption. In Section 4 there is a description of encapsulation schemes that says
We suggest an encapsulation ...
0
votes
0answers
36 views
Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?
I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
2
votes
1answer
65 views
What does the running transcript hash in RFC-8446: TLS 1.3 do?
From RFC8446:
In general, implementations can implement the transcript by keeping a
running transcript hash value based on the negotiated hash. Note,
however, that subsequent post-handshake ...
2
votes
1answer
44 views
Question about IETF RFC6979 determinisitc (EC)DSA document section 3.6 additional data k'
In RFC6979 document
https://tools.ietf.org/html/rfc6979
page 14~15, Section 3.6 "Variants"
o. Additional data may be added to the input of HMAC, concatenated
after bits2octets(H(m)):
...
1
vote
0answers
61 views
What's the difference between H(m) $\oplus$ H(key) and H(m || key) in MAC construction?
We all know that HMAC has the form of $H(ikey || H(okey || M))$. I'm wondering what if we replace the H(okey || M) into H(okey) $\oplus$ H(M)? In other words, is $$H\Big( ikey \mathbin\| \big( H(okey) ...
0
votes
1answer
62 views
How to calculate a hmac and cmac
I'm searching for a simple description that tells me in a schematic way how hmac and cmac is calculated.
So far I found the following:
...
0
votes
0answers
20 views
Why doesn't appending a message to a key instead of vice versa defeat length extension attack? [duplicate]
It's well established that H(K||M) is vulnerable to length extension attacks for SHA-2 and other hashing algorithms, and instead an HMAC construction should be used. However - why can't H(M||K) be ...
1
vote
2answers
58 views
Is nonce-less Encrypt-then-HMAC as secure as poly1305
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
2
votes
0answers
75 views
Encrypt-then-HMAC with a single key is secure?
The partition oracle attacks exploits the non-committing AEAD schemes.
Informally, a committing encryption scheme is one for which it is computationally intractable to find a pair of keys and a ...
0
votes
0answers
153 views
Bitcoin Key Recovery Without Nonce Re-Use
There are a lot of questions in these forums regarding the recovery of private keys.
But I'm here to postulate on something unique to a specific piece of research that I looked into recently.
The ...
1
vote
1answer
209 views
Generating HMAC(SHA256) keys using WebCrypto deriveKey() API
I am using the javascript WebCrypto API window.crypto.subtle.deriveKey() API to generate HMAC keys like this:
...
1
vote
0answers
21 views
Is Poly1305 enough for cascading ciphers? [duplicate]
ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
0
votes
1answer
62 views
How do high hash rates affect hashed password security?
Given the increase in hash rate since the rise of numerous block chains, I wonder how this affects the security of many hashed password systems.
Is a standard linux ...
0
votes
0answers
36 views
Authentication tag length and post-quantum security
The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
0
votes
0answers
26 views
Randomizing output of HKDF for the same input key material [duplicate]
Given HKDF and a master input material key $k$, I would like to derive ephemeral keys that cannot be linked together. If I understand correctly, the specification of $HKDF$ adding a unique random $...
1
vote
1answer
90 views
HKDF Bit Security
I've always understood the bit security of hash functions to be related to their output size (eg. collision resistance). However, I recently came across a table from a Wickr blog post that lists HKDF-...
1
vote
0answers
63 views
Forgery of the Carter-Wegman MAC
Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
3
votes
1answer
243 views
Is HMAC-SHA256 a PRF?
In the abstract of The Exact PRF-Security of NMAC and HMAC, Gazi, Pietrzak, and Rybar state:
NMAC was introduced by Bellare, Canetti and Krawczyk [Crypto’96], who proved it to be a secure
...
4
votes
1answer
105 views
Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?
As we know, MD5 and SHA1 (to some extent) are broken, and older algorithms like SHA0 or MD4 and MD2 are very broken.
Does this also imply that the corresponding HMACs are also broken?
Obviously nobody ...
0
votes
0answers
50 views
How secure is Encrypt-And-MAC?
From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
2
votes
2answers
296 views
Is E_k(M)||H(m) form of MAC secure?
Would this encryption and signing scenario be considered tamper-proof?
...
1
vote
0answers
33 views
Schnorr Protocol Implementation - Sometimes Fails on Curve25519
I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
2
votes
1answer
103 views
AES-128/CTR/NoPadding HMAC vs Signature
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
-1
votes
1answer
56 views
Encryption on one AES mode and decrypting on another, where both use HMAC
Let's say there are 2 ciphers, $enc$ and $dec$, where:
$enc$ will encrypt the data, and $dec$ will decrypt it.
Both $enc$ and $dec$ must be an AES cipher.
$enc$ and $dec$ will use the same key $k$ ...
3
votes
2answers
106 views
How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?
I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
2
votes
1answer
72 views
HMAC256(K,m) vs HMAC256(K,K)
I have a key size of 128 bits. My message size is fairly short (e.g., 32 bits - and widely known). Although I am doing a SHA256, the result of the HMAC will be truncated to 128 bits.
So my question is:...
3
votes
0answers
64 views
Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?
HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function.
The hash functions considered in that paper were ones based on the Merkle-...
1
vote
1answer
68 views
byte significance with hash functions
I am using the python hmac module to generate an authentication code. Given a key, message, and hash function (I am using md5), the library returns an authentication code as a python bytes object. I ...
2
votes
1answer
55 views
Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)
Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability?
This is what I mean about doing MtEtM:
...
2
votes
0answers
45 views
How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?
I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them.
For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...
2
votes
1answer
80 views
Encrypting data with HMAC-SHA1 challenge response as the key
I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data.
Generate a non-secret 64 byte random string $M$ (fixed challenge)
Generate ...
3
votes
1answer
41 views
Is HKDF one-way, namely given `Ko` it's hard to guess `Ki`?
For background, a HKDF (hmac based key derivation function) takes the form of Ko = KDF(Ki, Label, Context, Len) where Ki is the ...
2
votes
2answers
109 views
Prove that you have the data when hash is public
I am designing an online service where users can upload files (3d models) for processing. I want to speed up things when the same file is uploaded by many different users by allowing them to post a ...
2
votes
1answer
70 views
PBKDF2-HMAC Collisions
Trying to understand the well known property of these collisions when used with SHA1, SHA256, etc. where a given key is larger than the block size of the digest function. In these cases the smaller of ...
3
votes
1answer
109 views
Create a TOTP for machines using HMAC or AES
I'm trying to create a sort of Time-based One Time Password (TOTP) where machines are involved (not humans). In this kind of TOTP the step is 15 minutes between one code to the next one and both ...
2
votes
1answer
109 views
Is an HMAC based on a second-preimage resistant hash function always unforgeable?
If hash function is collision-resistant, then its associated HMAC is always unforgeable. But suppose that a hash function is only second-preimage resistant, not necessarily collision-resistant. Then ...
-1
votes
2answers
199 views
Does HMAC support or guarantee confidentiality? [closed]
I know that HMAC supports or guarantees both authentication and integrity, but does it also provide confidentiality?
1
vote
2answers
89 views
Break HMAC-SHA256 of PAN with known hash?
Imagine a database containing hashed (HMAC) Primary Account Numbers (PANs ) and associated identifiable information (e.g. transactions).
Consider a data breach. Prior to the breach, an attacker made ...
1
vote
1answer
138 views
Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?
Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is:
take a secret material which will work as "generator&...
1
vote
1answer
82 views
Authenticated, Quantum-resistant GPG2?
GPG2 does not provide authentication. It still uses SHA-1 by default. It does not seem to get any stronger as time goes by.
If one were to pass a randomly-generated symmetric key (from a TRNG) over ...
0
votes
1answer
60 views
Is it safe to use the same password/secret for both VeraCrypt volume and its HMAC?
I am trying to script the integrity check of a VeraCrypt volume.
...
3
votes
2answers
165 views
Extending AES-GCM initialization vector
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
5
votes
1answer
635 views
How is it possible that these two encryption functions yield the same result?
I opened this post in stackoverflow some time ago where I explained a problem I had about not finding a way that would allow to successfully get the result of a string encrypted with a "aes-256-...
1
vote
1answer
91 views
HMAC SHA256 - fixed vs dynamic key - security and collision impacts
Assume we should apply an hmac sha256 on different messages made of incremental numbers (Ex. 1 to 1 billion).
Does it make sense in terms of security to apply a different fixed key for each message?
...
3
votes
1answer
116 views
With AES encryption and a known key and plaintext, can an attacker create a different key and plaintext resulting in the same ciphertext?
In short: with AES encryption can an attacker create a new key2 and plaintext2 so that AESkey1(plaintext1) = AESkey2(plaintext2)
If so, can it be solved by just applying for instance a MAC like AES-...
2
votes
1answer
52 views
HMAC for hash list
If I have a very large input to hash with a hash function vulnerable to length extention and I am using a hash list, should I HMAC each part of the input or just HMAC the final hash of all the hashes ?...
0
votes
1answer
80 views
Using HMAC with AES modes that do NOT require padding [closed]
I'm trying to use HMAC with AES modes that do not require any sort of padding.
Although I am aware that modes like AES-GCM and ...
6
votes
1answer
173 views
OpenSSL FIPS integrity check
As far as I know, FIPS requires a set of self tests (POST) to verify the cryptographic algorithms permitted and the integrity of the module.
These tests are performed at run-time, so OpenSSL does a ...
2
votes
1answer
67 views
What is the best way of deterministically choosing N of M, given 32 bytes of sha256?
I have a list of M=10,000..100,000 items and 32 bytes of sha256 H.
I want to choose N=10..100 items (without order).
Is there an efficient way to do this?
Or should I use something like ...
2
votes
0answers
47 views
Why the salt is used as a key in the extract phase of HKDF?
What is the reason that in the HKDF standard (RFC5869), in the "extract" phase, the 'salt" parameter is instantiated as HMAC key, and the secret keying material 'IKM' is instantiated as HMAC input ...
