Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
472
questions
0
votes
0answers
40 views
What's the use of HMAC in PBKDF2? [duplicate]
As far as I know, PBKDF2 uses an underlying pseudorandom function in order to generate a hash (like SHA256) so as far I understood PBKDF2 is basically a hash function that uses an underlying function ...
1
vote
1answer
116 views
Protect the original message of a hash from brute force
My apologies for the somewhat inaccurate terminology.
Basically I have some simple messages (entropy ~50 bits) the user will use for registration. The messages should remain private, and I don't ...
1
vote
1answer
60 views
HMAC of message hash
If I have a message m and want its HMAC, I can simply do HMAC(k, m). But sometimes I am not given ...
0
votes
1answer
62 views
An unusual use-case for HMAC as compression function in web browsers
It's an unfortunate fact that, right now (2019), browsers don't expose standardized streaming hashing interfaces in SubtleCrypto. The only way to hash a file, is to ...
1
vote
1answer
76 views
Is it OK to just hash a symmetric key to derive an authentication key?
I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
0
votes
1answer
39 views
Termonology help: What is using AEAD without encrypting data called?
I'm using ChaCha20-Poly1305 in a "full AEAD" mode, where a payload of data is encrypted and a block of unencrypted "additional data" is secured as well.
However, I'd like to also occasionally use the ...
0
votes
2answers
78 views
Does HMAC provide anything that AEAD does not?
Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available)
Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
0
votes
0answers
58 views
Some curiosity about HMAC
Is the probability of distinguishing HMAC from a random oracle is the same as the probability of forging HMAC?
Can we say that the following statement is trivial?
$\Pr[\text{Forging $\operatorname{...
1
vote
1answer
88 views
are there more efficient methods than HMAC to achieve convergent encryption?
I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...
0
votes
0answers
43 views
Probability of collision of two HMACs with two random keys
Assume $k_1$ and $k_2$ are two $\lambda$ bit random number ($|k_1|=|k_2|=\lambda$), and HMAC generates $f(\lambda)$ bit tag. How much is the probability of their collision for an input message $m$?
$...
1
vote
1answer
75 views
Is this function a secure MAC?
Consider the following function:
$f_k(mm')=\operatorname{HMAC}_{\operatorname{HMAC}_k(m)}(mm')$
Can I use $f$ as a secure MAC?
1
vote
1answer
43 views
What is the best way to forge a tag for a determined message?
Assume a PPT adversary wants to forge a tag for a message. The adversary has oracle access to verification function. Adversary knows that tags are generated by HMAC-SHA256 with 128-bit key. I think ...
1
vote
0answers
46 views
Security of HMAC against an eavesdropper
Assume we are using HMAC-SHA-256 with 128-bit key for authenticating our messages, and an adversary has eavesdropped $n$ (message, tag) pairs.
If the adversary wants to forge a tag for a message $m'$,...
1
vote
0answers
43 views
Yubico’s take on U2F wrapping: purpose of MAC?
I've been reading up on Yubico's implementation of U2F.
I am confused on the purpose of the message authentication code (MAC). It prevents an attacker from providing a key handle (particularly a ...
1
vote
1answer
42 views
Forging a valid tag for an arbitrary message when you have some knowledge about the key
I am using HMAC-SHA256 with a 128-bit key. Assume my key generator leaks some information to an adversary. Hence, the adversary can predict the key with probability $\alpha$. Can I say that the ...
0
votes
1answer
41 views
Is using the same key for different message HMACs insecure?
When using the MAC-then-Encrypt composition, would using the same key for the HMAC in each different message be insecure?
1
vote
1answer
43 views
Is it safe to compute HMAC(Base64(IV) || “,” || Base64(CipherText)) instead of HMAC(IV || CipherText)?
Let || be the concatenation operator.
Let CipherText = AES(Key1, IV, Message).
Let us assume AES is used in CBC mode.
I want ...
5
votes
1answer
331 views
Are there any known problems or attacks for using SHA1(AES_key) as the HMAC key?
See this answer that explains the following sequence of operations:
CipherText = IV|| AES(key1,iv,message)
tag = hmac(key2,ciphertext)
That answer says,
You ...
1
vote
0answers
25 views
Secret key suffix vs HMAC [duplicate]
What is the benefit of using HMAC over hash with key suffix? I realize that using key prefix is a bad idea because it allows message extension attacks. When adding key as a suffix such attack ...
0
votes
1answer
58 views
HMAC based Key exchange
Alice and Bob need to share public keys to sign/verify ephemeral keys. They have a secret key $K$.
Alice generates a 32 bytes random number $A$, computes $\operatorname{HMAC-SHA256}(K, M||A)$ and ...
0
votes
2answers
69 views
HMAC for round-trip validation
I have a need to produce URLs to allow the downloading of a single file, without authentication. These links will be sent through email, and I understand and accept the risk of a given link being ...
-2
votes
1answer
77 views
Why do we need HMAC?
AFAIK, HMAC solves the collision problem of hash algorithms by mixing in a pre shared secret.
Can't we just use the pre shared secret to symmetrically encrypt data and leave out the hashing?
0
votes
0answers
38 views
Differences between MAC and HMAC [duplicate]
After reading many posts, I am still confused about the differences between these two.
Let me know if my understanding is correct:
MAC is encrypted string that is generated using a secret key and a ...
2
votes
2answers
123 views
Parallelizing MACs by subdividing the message and then aggregating results
Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC.
Could these be securely parallelized by computing multiple MACs in parallel and then combining the ...
0
votes
1answer
67 views
Which HMAC scheme more secure?
Which HMAC scheme is more secure? Or are they of the same level of security?
Scheme One
Compute a HMAC on the data to encrypt (cleartext/plaintext)
Encrypt the data with AES_CTR_256, and append ...
0
votes
1answer
86 views
Is using the same MAC twice insecure?
I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key.
Here is the full recipe:
Compute a HMAC on the data to encrypt, and append it to the ...
1
vote
4answers
245 views
How is PBKDF2 so much better than normal Hashing or even using HMAC
I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better ...
0
votes
0answers
32 views
What is used as a KEY and MESSAGE when using HMAC within a PBKDF2? [duplicate]
I was studying WPA2 and it's security when I came across this problem. I know that WPA2 uses PBKDF2 to generate a Pairwise Master Key. It does something like this;
...
0
votes
2answers
40 views
Determining susceptibility to frequency analysis
I'm looking to create some tokens using a keyed hash mechanism to represent our individual customers. I was planning on using combinations of the customer's personal information (e.g. ...
0
votes
1answer
111 views
How to decide whether to use digital signature (RSA) or HMAC
I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other?
These are some examples:
HMAC SHA256 vs RSA SHA256 - which one to use
What are the ...
2
votes
1answer
77 views
Why there isn't a consistent key transform function of HMAC?
I am currently learning, the internal working of HMAC. There exists a key transformation process in the beginning, which works as follows:-
Make the length of $K$ (Key) equal to $B$ (number of bits ...
2
votes
1answer
57 views
Can HKDF be instantiated with HMAC-SWIFFT?
While reading through "Cryptographic Extraction and Key Derivation: The HKDF Scheme" by Hugo Krawczyk, I found the following text intriguing:
In some cases, well-defined combinatorial assumptions ...
0
votes
2answers
49 views
Quick scan which data (hmac/fernet) can be decrypted with a key?
I am designing a secure vault, which stores tens of thousands of encrypted messages and authenticated with Fernet/HMAC, A user query the vault with a key, could I use some kind of index to tell if the ...
0
votes
1answer
48 views
Is OpenSSL HMAC vulnerable to length extesion attacks when using MD5 as hash algorithm?
Given that a valid hash for a specific payload is known, would some C code like this be vulnerable to a length extension attack?
...
0
votes
0answers
163 views
Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]
I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
2
votes
1answer
125 views
Is this protocol for masking DB ids sound?
Problem Statement
I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...
1
vote
1answer
74 views
Security of 64-bit truncated HMAC of Matrix protocol
I have seen other questions like this one, but I am asking this specifically in the context of Riot messaging and the underlying Matrix protocol.
A basic summary of their message encryption (using ...
0
votes
0answers
29 views
Mixed HMAC / GMAC with fixed IV [duplicate]
I was just thinking about improving the performance of HMAC - what would be the issues in doing the following:
Let $G_K(IV,M)$ be GMAC with a key $K$, for IV and message $M$.
Let $H$ be a secure hash ...
1
vote
3answers
586 views
How does AWS Secret key and access key work
Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client?
My guess is:
AWS access key ID is a form of unique user/account identifier
AWS ...
1
vote
1answer
150 views
AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them
I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
6
votes
2answers
362 views
Would a HMAC digest make sense in an RSA / ECDSA signature?
When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
2
votes
1answer
97 views
HMAC computation using AES key
I want to compute an HMAC value of a data set using CKM_SHA256_HMAC mechanism with AES key. I have the error code CKR_KEY_TYPE_INCONSISTENT because it seems that I need to use a key of key_type ...
1
vote
1answer
111 views
Hash for use in embedded HMAC application
I developed a GNSS logger (http://flysight.ca) which has become popular for scoring skydiving competitions. At the moment, there is little protection against competitors falsifying tracks, but I would ...
2
votes
1answer
80 views
Authenticated encryption and file data integrity
I've got a task to provide the integrity and an authenticated encryption for files in our application. I need an assurance if my way of thinking is correct.
I can't use AES GCM, I have to stay with ...
0
votes
0answers
111 views
Is reverse engineering SHA256-HMAC function possible? [duplicate]
Assume HMAC function is used to generate a 6-digt integers time-based onetime password. As follows:
$$K_h =\operatorname{HMAC}(k,t) = H((k\oplus\text{opad})\mathbin\| H((k\oplus\text{ipad})\mathbin\|...
3
votes
0answers
61 views
Orignal Krawczyk's HKDF vs latest NIST SP800-56C
I've noticed that the original HKDF in rfc5869 defines a feedback loop. So the pseudo-code is something like:
...
4
votes
1answer
257 views
Worth taking performance hit of HMAC to gain additional security?
It seems like SHA-512 truncated to 256 bits is usable as a MAC [1]. The advantage is that it's ~50% faster than HMAC-SHA-256 on 64-bit CPUs and ~50% faster than HMAC-SHA-512 on short inputs. (My use ...
-3
votes
1answer
87 views
Which is more secure? $\operatorname{AES-ECB}(key,\operatorname{SHA1}(data+key))$ vs $\operatorname{HMAC-SHA1}(key, data)$ [closed]
$\operatorname{AES-ECB}(key,\operatorname{SHA1}(data+key))$ vs $\operatorname{HMAC-SHA1}(key, data)$
Which is more secure?
Which is faster?
There is a similar comparison here; HMAC-SHA1(key, data) ...
5
votes
2answers
649 views
GMAC vs HMAC in message forgery and bandwidth
Saarinen in his work GCM, GHASH and Weak Keys says that:
The GHASH algorithm belongs to a widely studied class of Wegman-Carter
polynomial universal hashes. The security bounds known (this and ...
2
votes
0answers
35 views
Is there an instance where integrity protecting metadata is bad?
In JWEs there's a unprotected data field as well as recipients are not integrity protected. Is there a case where integrity protecting this data would be a problem? If it doesn't make a difference, ...
