Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
1 vote
1 answer
44 views

Can asymmetric encryption be used in HMAC, and still ensure the data has not been tampered with? [closed]

Suppose I want to send a message, but not privately; I want everybody to see it, even an attacker in the middle. I would do this by appending a public key to the start of the data, which could be used ...
user avatar
  • 11
3 votes
2 answers
471 views

Is HMAC part of the TLS/SSL process?

Does HMAC take part in TLS/SSL? When the client and the server pass the TLS handshake and create a common SESSION key, do they also HMAC each message that is being sent out for the purpose of data ...
user avatar
1 vote
1 answer
116 views

Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?

Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
user avatar
  • 13.9k
1 vote
1 answer
161 views

Why does the RFC version of HKDF-Expand start the counter at 1?

In RFC 5869, the definition of HKDF-Expand is given as follows, with the terminating counter value ranging from 1 to (presumably) 255: ...
user avatar
1 vote
1 answer
56 views

HMAC data and key swap

In some contexts (HKDF (RFC-5869 sec 2.2) and Bitcoin's BIP32 (master key generation)), I have seen the key and the data swapped for HMAC. E.g., let HMAC be a function $h:\{0,1\}^c \times \{0,1\}^b \...
user avatar
0 votes
1 answer
34 views

Storing 4 char prefix for 32bit hex token after storing HMAC digest

Currently I am working on a public api that uses token authentication. The token is a 32 bit random hex that is shared with the user and then stored in our database as an HMAC digest using a secret ...
user avatar
0 votes
0 answers
60 views

Can a circuit in a zk-SNARK be reversed-engineered?

The definition of zk-SNARK involves not leaking any information from the prover-verifier interaction, but what about leaking information from the circuit itself? e.g., could there be a circuit to ...
user avatar
  • 1
0 votes
0 answers
37 views

Is Using HMAC-SHA256(key, counter) For Providing Pad Only Vulnerable To Bruteforce?

...
user avatar
0 votes
0 answers
19 views

Has reducing MAC size and increasing message size the same effect on security?

I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
user avatar
  • 101
1 vote
0 answers
106 views

Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?

The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
user avatar
0 votes
1 answer
78 views

CTR HMAC SHA1 vs GCM Key management

The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1. For my thesis I want to research if GCM would be a better option. Therefore I read following discussion. There the answer was that GCM ...
user avatar
  • 15
1 vote
1 answer
67 views

Where should MAC keys come from in a one time pad situation?

I refer to questions For a one-time pad, which MAC method is information-theoretically secure?, Seeking clarification of OTP & MAC discussion and this page illustrating various MACi. And the ...
user avatar
  • 13.9k
0 votes
1 answer
129 views

DIY: password key derivation tool using PBKDF2 / HMAC

First of all, I don't want to reinvent the wheel, just want to build my own car. Non-product environment; only for fun and entertainment. The goal is to use a single private (and never published) ...
user avatar
5 votes
1 answer
216 views

HKDF randomness extraction - salt or no salt?

According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction. This question is solely about the necessity of a salt for the purposes of randomness ...
user avatar
  • 2,698
3 votes
1 answer
94 views

Applications in which you should/shouldn't use a salt with HKDF

rfc5869 has the following to say about the use or lack thereof of salts with HKDF: HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
user avatar
2 votes
2 answers
151 views

Why bother to generate Key, IV and encrypt them?

When we perform encryption with Public or Private Key, Asymmetric AES with RSA and CBC 128, and when we use the padding as well. Why do we have to bother adding the additional: Key + IV? ...
user avatar
0 votes
3 answers
132 views

Zero-knowledge proof of HMAC digest

I'm reading the Wikipedia for HMAC, and I feel a little bit lost. I'm wondering if there exists... $$digest = \operatorname{HMAC}(msg, key)$$ Is it possible to prove that $digest$ is computed from $...
user avatar
1 vote
0 answers
163 views

Why does HMAC use the hash twice? [duplicate]

According to the HMAC specification in RFC2104, an HMAC is computed in the following way: HMAC(K, text) = H(K XOR opad, H(K XOR ipad, text)) where ...
user avatar
2 votes
1 answer
70 views

Should I use HMAC to create a multiple part HASH token

I have a web API with a custom API authentication system that users each have a SecretKey and a public ApiKey. Using these two keys client(or user) can generate a token for the authentication on the ...
user avatar
2 votes
0 answers
43 views

key reuse: does knowing H(S) reveal HMAC(S)

given a hash H() , like sha256 and a secret text S and a public salt P will knowing H(S) reveal HMAC(P, S) ? to clarify: the question is if it possible to learn the digest, not the secret. In my ...
user avatar
  • 121
0 votes
1 answer
86 views

Reverse SHA256 Hashed Value from Multiple Instances where Part of Hashed Value is known

I apologize in advance if this question has been answered already. However, I have not been able to find an existing answer - despite the case being pretty simple and common I imagine. Perhaps there ...
user avatar
1 vote
2 answers
240 views

Why is birthday attack invalid on this MAC

I am trying to understand why the following birthday attack is invalid for this MAC construction. Let Mac : $\{0, 1\}^{128} \times \{0, 1\}^{256} \to \{0, 1\}^{128}$ be a MAC. Consider the following ...
user avatar
0 votes
0 answers
16 views

Use HMAC for every block encryption operation [duplicate]

Is it possible to use HMAC while performing encryption of blocks? I think that the main problem with the approach would be to get the same output size as the block, from the HMAC function. Also, the ...
user avatar
0 votes
1 answer
74 views

Can a one time public key'd HMAC be secure?

Imagine authentication like $hmac = H(nonce, ciphertext)$. $nonce$ is truly random and chosen (randomly and WITHOUT replacement) from predetermined set $N$. So ${nonce} \in N$ and once used cannot be ...
user avatar
  • 13.9k
0 votes
0 answers
36 views

What is the difference between HMAC-SHA3-512 and KMAC? [duplicate]

Reading through the wikipedia entry for HMAC I see that SHA-3 can be used with the HMAC algorithm to give HMAC-SHA3-512. I also know that there is KMAC, which from ...
user avatar
  • 133
0 votes
1 answer
84 views

How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?

In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general. I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
user avatar
  • 91
0 votes
2 answers
185 views

Is there any good attack model of HMAC?

Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
user avatar
0 votes
0 answers
140 views

What is the need of xor-ing the key with an outer and inner pad in HMAC?

The diagram above shows the standard HMAC algorithm. However consider the algorithm of HMAC without xoring the key with outer or inner pad. In other words let the structure of HMAC remain the same ...
user avatar
1 vote
1 answer
54 views

Is the collision chance 2^(n/2) of an n-bit tag τ unchanged if reduced to (n/2)-bits using a reduction of τ to some 2^(n/2) order group element?

If $H(k, Μ) = τ$, in the context where $τ$ is an $n$-bit tag produced as a mac on a key, $k$, and a message, $M$, through a keyed-hash function, $H$, is there a function $F(τ) = T$ that transforms $τ$ ...
user avatar
  • 23
5 votes
1 answer
366 views

Does hashing an ECB encryption with a strong hash function produce a secure MAC?

Does applying a strong hash function like SHA-256 to the ECB-encryption of a message (using some secret key $K$) produce a secure mac? For example, given a message $m$, would a simple mac construction ...
user avatar
  • 229
1 vote
1 answer
110 views

HMAC key generation and encoding

I've this piece of .NET code that is based on a Microsoft sample on how to generate a key and sign using HMACSH256. But I've altered the key generation a little bit and also decided to use Base64 to ...
user avatar
0 votes
1 answer
139 views

What authenticated encryption do kerberos use in windows?

I have learned about the kerberos protocol and seen that the windows version uses a couple of authenticated encryption schemas (like rc4-hmac-md5). What type of authenticated encryption is it? Is it a:...
user avatar
  • 175
0 votes
1 answer
48 views

Necessity of PBKDF2 in current Setup?

I have a single password which is random bytes that encrypts a database. Right now I am using an encryption scheme of https://gist.github.com/jbtule/4336842. To summarize, we take our one password, ...
user avatar
2 votes
1 answer
68 views

Can future time-based keys be deduced from a previous key?

If a time-based key generated by an authenticator app like Google Authenticator is compromised, can future keys be deduced from the compromised key?
user avatar
  • 23
0 votes
1 answer
274 views

Does SHA384 make sense with HMAC-SHA256?

In the sense of security level (as defined, for example, by Ferguson and Schneier in the book Practical Cryptography), does it make sense to use SHA384 with HMAC-SHA256 in the general settings. By ...
user avatar
  • 115
0 votes
1 answer
91 views

Use peppers with Bcrypt (HMAC + Bcrypt)

Is it useful to combine HMAC with Bcrypt ? If it so, should I do the HMAC on the password before "Bcrypt"ing it ? or should I do the HMAC on the Bcrypt output ?
user avatar
0 votes
0 answers
56 views

Managing master keys used in PBKDF2 and HMAC (store, rotate)

My use case: I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...). I use these master keys in two specific ...
user avatar
0 votes
0 answers
24 views

HMAC vs hashing (data + pepper) [duplicate]

Is there a difference between HMAC and hashing (data + pepper) or both of them are equally secure ?
user avatar
2 votes
2 answers
119 views

AWS signature v4 key derivation

Generating Authorization header with AWS signature v4 involves deriving signing key as follows: https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html ...
user avatar
0 votes
1 answer
39 views

Complexity of deriving message from CMAC vs HMAC when the key is known

From the description of CMAC and HMAC, given the key and the tag, I think it is easy to derive the CMAC message than the HMAC message. After obtaining the key and tag for CMAC, an intruder can apply ...
user avatar
1 vote
1 answer
79 views

How to compose multiple values to MAC authenticate?

If the data I want to authenticate consists of multiple values and I compute a MAC simply concatenating the values, an adversary can "shift" characters within those values without ...
user avatar
2 votes
0 answers
37 views

Confused about encapsulation using different types of hash functions

I'm reading Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption. In Section 4 there is a description of encapsulation schemes that says We suggest an encapsulation ...
user avatar
  • 408
0 votes
0 answers
48 views

Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?

I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
user avatar
  • 1
2 votes
1 answer
218 views

What does the running transcript hash in RFC-8446: TLS 1.3 do?

From RFC8446: In general, implementations can implement the transcript by keeping a running transcript hash value based on the negotiated hash. Note, however, that subsequent post-handshake ...
user avatar
2 votes
1 answer
90 views

Question about IETF RFC6979 determinisitc (EC)DSA document section 3.6 additional data k'

In RFC6979, on page 14, Section 3.6 "Variants": o. Additional data may be added to the input of HMAC, concatenated after bits2octets(H(m)): ...
user avatar
  • 41
1 vote
0 answers
99 views

What's the difference between H(m) $\oplus$ H(key) and H(m || key) in MAC construction?

We all know that HMAC has the form of $H(ikey || H(okey || M))$. I'm wondering what if we replace the H(okey || M) into H(okey) $\oplus$ H(M)? In other words, is $$H\Big( ikey \mathbin\| \big( H(okey) ...
user avatar
  • 115
0 votes
1 answer
138 views

How to calculate a hmac and cmac

I'm searching for a simple description that tells me in a schematic way how hmac and cmac is calculated. So far I found the following: ...
user avatar
  • 39
1 vote
2 answers
103 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
user avatar
2 votes
0 answers
120 views

Encrypt-then-HMAC with a single key is secure?

The partition oracle attacks exploits the non-committing AEAD schemes. Informally, a committing encryption scheme is one for which it is computationally intractable to find a pair of keys and a ...
user avatar
  • 43.4k
0 votes
0 answers
469 views

Bitcoin Key Recovery Without Nonce Re-Use

There are a lot of questions in these forums regarding the recovery of private keys. But I'm here to postulate on something unique to a specific piece of research that I looked into recently. The ...
user avatar
  • 115

1
2 3 4 5
12