Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
1
vote
1answer
59 views

SHA1 standard steps

I'm a computer engineering student and I want to implement a cryptographic function for a college project. I want to realize my personal implementation of a WPA2 hash producer in C (and upload it to ...
1
vote
2answers
103 views

Can a MAC be used as a HMAC?

I am reading through an information security book right now, and a confusing question poses itself to me: "Could you use a MAC as a HMAC? That is, does a MAC satisfy the same properties that a ...
8
votes
1answer
1k views

How many codes can I safely generate using the same HMAC key?

Can an attacker guess the key given enough codes for the same key? And if so, how many times is it safe to use the same key?
1
vote
2answers
72 views

How to design a secure challange-response authentication protocol?

I am implementing a custom challenge-response protocol to authenticate a client to a server. Mutual authentication is not required, i.e. the server doesn't need to be authenticated to the client. The ...
0
votes
1answer
31 views

Using the output of HKDF directly

I am using HKDF with an IKM and salt, the OKM is used as the key for an HMAC operation. The HMAC algorithm is authenticating messages in a communications system The salt is the concatenation of 2 ...
0
votes
1answer
48 views

Length extension attacks, Merkle–Damgård constructions, and HMACs

The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks." However, HMACs can be ...
-1
votes
1answer
27 views

How to implement nonce for hashing a 6 digit sensitive number with hmac with its secret key

I have to pass a 6 digit number which has to be kept very secret through a unsecured netwok. I am thinking to hash it using hmac and a secret key which only me and the reciever knows So the code ...
1
vote
1answer
48 views

can I use PBKDF2 instead of hmac as a hashing tool for sensitive data

I have read about hmac and PBKDF2. PBKDF2 - is mainly used for password hashing. It uses ...
1
vote
1answer
65 views

Security Considerations in using SHA-1 for One Time Passwords

SHA-1 is considered broken. That's why I'm assuming that using SHA-1 for RFC2289 OTPs is broken as well. Is this assumption correct? Going further with this assumption using SHA-1 for RFC4226 HOTPs ...
2
votes
2answers
52 views

Can the HMAC of a pre-hash be considered equivalent to an HMAC of the message?

Assume: size of m = 1kB HMAC hashing function = SHA256 H hashing function = SHA256 It seems reasonable to think that there would be no difference in authenticating a message if either HMAC(k, m) or ...
-3
votes
1answer
93 views

The output size is smaller than input size is a insecure to hash function [closed]

Why it will be unsafe, and can be break?
0
votes
0answers
42 views

What's the use of HMAC in PBKDF2? [duplicate]

As far as I know, PBKDF2 uses an underlying pseudorandom function in order to generate a hash (like SHA256) so as far I understood PBKDF2 is basically a hash function that uses an underlying function ...
1
vote
1answer
119 views

Protect the original message of a hash from brute force

My apologies for the somewhat inaccurate terminology. Basically I have some simple messages (entropy ~50 bits) the user will use for registration. The messages should remain private, and I don't ...
1
vote
1answer
71 views

HMAC of message hash

If I have a message m and want its HMAC, I can simply do HMAC(k, m). But sometimes I am not given ...
0
votes
1answer
72 views

An unusual use-case for HMAC as compression function in web browsers

It's an unfortunate fact that, right now (2019), browsers don't expose standardized streaming hashing interfaces in SubtleCrypto. The only way to hash a file, is to ...
1
vote
1answer
83 views

Is it OK to just hash a symmetric key to derive an authentication key?

I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
0
votes
1answer
42 views

Termonology help: What is using AEAD without encrypting data called?

I'm using ChaCha20-Poly1305 in a "full AEAD" mode, where a payload of data is encrypted and a block of unencrypted "additional data" is secured as well. However, I'd like to also occasionally use the ...
0
votes
2answers
91 views

Does HMAC provide anything that AEAD does not?

Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available) Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
0
votes
0answers
60 views

Some curiosity about HMAC

Is the probability of distinguishing HMAC from a random oracle is the same as the probability of forging HMAC? Can we say that the following statement is trivial? $\Pr[\text{Forging $\operatorname{...
1
vote
1answer
101 views

are there more efficient methods than HMAC to achieve convergent encryption?

I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...
0
votes
0answers
44 views

Probability of collision of two HMACs with two random keys

Assume $k_1$ and $k_2$ are two $\lambda$ bit random number ($|k_1|=|k_2|=\lambda$), and HMAC generates $f(\lambda)$ bit tag. How much is the probability of their collision for an input message $m$? $...
1
vote
1answer
85 views

Is this function a secure MAC?

Consider the following function: $f_k(mm')=\operatorname{HMAC}_{\operatorname{HMAC}_k(m)}(mm')$ Can I use $f$ as a secure MAC?
1
vote
1answer
45 views

What is the best way to forge a tag for a determined message?

Assume a PPT adversary wants to forge a tag for a message. The adversary has oracle access to verification function. Adversary knows that tags are generated by HMAC-SHA256 with 128-bit key. I think ...
1
vote
0answers
46 views

Security of HMAC against an eavesdropper

Assume we are using HMAC-SHA-256 with 128-bit key for authenticating our messages, and an adversary has eavesdropped $n$ (message, tag) pairs. If the adversary wants to forge a tag for a message $m'$,...
1
vote
0answers
45 views

Yubico’s take on U2F wrapping: purpose of MAC?

I've been reading up on Yubico's implementation of U2F. I am confused on the purpose of the message authentication code (MAC). It prevents an attacker from providing a key handle (particularly a ...
1
vote
1answer
43 views

Forging a valid tag for an arbitrary message when you have some knowledge about the key

I am using HMAC-SHA256 with a 128-bit key. Assume my key generator leaks some information to an adversary. Hence, the adversary can predict the key with probability $\alpha$. Can I say that the ...
0
votes
1answer
46 views

Is using the same key for different message HMACs insecure?

When using the MAC-then-Encrypt composition, would using the same key for the HMAC in each different message be insecure?
1
vote
1answer
44 views

Is it safe to compute HMAC(Base64(IV) || “,” || Base64(CipherText)) instead of HMAC(IV || CipherText)?

Let || be the concatenation operator. Let CipherText = AES(Key1, IV, Message). Let us assume AES is used in CBC mode. I want ...
5
votes
1answer
332 views

Are there any known problems or attacks for using SHA1(AES_key) as the HMAC key?

See this answer that explains the following sequence of operations: CipherText = IV|| AES(key1,iv,message) tag = hmac(key2,ciphertext) That answer says, You ...
1
vote
0answers
28 views

Secret key suffix vs HMAC [duplicate]

What is the benefit of using HMAC over hash with key suffix? I realize that using key prefix is a bad idea because it allows message extension attacks. When adding key as a suffix such attack ...
0
votes
1answer
61 views

HMAC based Key exchange

Alice and Bob need to share public keys to sign/verify ephemeral keys. They have a secret key $K$. Alice generates a 32 bytes random number $A$, computes $\operatorname{HMAC-SHA256}(K, M||A)$ and ...
0
votes
2answers
77 views

HMAC for round-trip validation

I have a need to produce URLs to allow the downloading of a single file, without authentication. These links will be sent through email, and I understand and accept the risk of a given link being ...
-2
votes
1answer
80 views

Why do we need HMAC?

AFAIK, HMAC solves the collision problem of hash algorithms by mixing in a pre shared secret. Can't we just use the pre shared secret to symmetrically encrypt data and leave out the hashing?
0
votes
0answers
43 views

Differences between MAC and HMAC [duplicate]

After reading many posts, I am still confused about the differences between these two. Let me know if my understanding is correct: MAC is encrypted string that is generated using a secret key and a ...
2
votes
2answers
129 views

Parallelizing MACs by subdividing the message and then aggregating results

Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC. Could these be securely parallelized by computing multiple MACs in parallel and then combining the ...
0
votes
1answer
81 views

Which HMAC scheme more secure?

Which HMAC scheme is more secure? Or are they of the same level of security? Scheme One Compute a HMAC on the data to encrypt (cleartext/plaintext) Encrypt the data with AES_CTR_256, and append ...
0
votes
1answer
104 views

Is using the same MAC twice insecure?

I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key. Here is the full recipe: Compute a HMAC on the data to encrypt, and append it to the ...
1
vote
4answers
380 views

How is PBKDF2 so much better than normal Hashing or even using HMAC

I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better ...
0
votes
0answers
32 views

What is used as a KEY and MESSAGE when using HMAC within a PBKDF2? [duplicate]

I was studying WPA2 and it's security when I came across this problem. I know that WPA2 uses PBKDF2 to generate a Pairwise Master Key. It does something like this; ...
0
votes
2answers
41 views

Determining susceptibility to frequency analysis

I'm looking to create some tokens using a keyed hash mechanism to represent our individual customers. I was planning on using combinations of the customer's personal information (e.g. ...
0
votes
1answer
131 views

How to decide whether to use digital signature (RSA) or HMAC

I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other? These are some examples: HMAC SHA256 vs RSA SHA256 - which one to use What are the ...
2
votes
1answer
83 views

Why there isn't a consistent key transform function of HMAC?

I am currently learning, the internal working of HMAC. There exists a key transformation process in the beginning, which works as follows:- Make the length of $K$ (Key) equal to $B$ (number of bits ...
2
votes
1answer
67 views

Can HKDF be instantiated with HMAC-SWIFFT?

While reading through "Cryptographic Extraction and Key Derivation: The HKDF Scheme" by Hugo Krawczyk, I found the following text intriguing: In some cases, well-defined combinatorial assumptions ...
0
votes
2answers
53 views

Quick scan which data (hmac/fernet) can be decrypted with a key?

I am designing a secure vault, which stores tens of thousands of encrypted messages and authenticated with Fernet/HMAC, A user query the vault with a key, could I use some kind of index to tell if the ...
0
votes
1answer
56 views

Is OpenSSL HMAC vulnerable to length extesion attacks when using MD5 as hash algorithm?

Given that a valid hash for a specific payload is known, would some C code like this be vulnerable to a length extension attack? ...
0
votes
0answers
207 views

Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
2
votes
1answer
128 views

Is this protocol for masking DB ids sound?

Problem Statement I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...
1
vote
1answer
86 views

Security of 64-bit truncated HMAC of Matrix protocol

I have seen other questions like this one, but I am asking this specifically in the context of Riot messaging and the underlying Matrix protocol. A basic summary of their message encryption (using ...
3
votes
3answers
965 views

How does AWS Secret key and access key work

Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client? My guess is: AWS access key ID is a form of unique user/account identifier AWS ...
1
vote
1answer
197 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...

1
2 3 4 5
10