Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
0
votes
1answer
38 views

How to calculate a hmac and cmac

I'm searching for a simple description that tells me in a schematic way how hmac and cmac is calculated. So far I found the following: ...
1
vote
1answer
71 views

HKDF Bit Security

I've always understood the bit security of hash functions to be related to their output size (eg. collision resistance). However, I recently came across a table from a Wickr blog post that lists HKDF-...
2
votes
1answer
86 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
2
votes
0answers
67 views

Encrypt-then-HMAC with a single key is secure?

The partition oracle attacks exploits the non-committing AEAD schemes. Informally, a committing encryption scheme is one for which it is computationally intractable to find a pair of keys and a ...
1
vote
2answers
51 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
0
votes
0answers
20 views

Why doesn't appending a message to a key instead of vice versa defeat length extension attack? [duplicate]

It's well established that H(K||M) is vulnerable to length extension attacks for SHA-2 and other hashing algorithms, and instead an HMAC construction should be used. However - why can't H(M||K) be ...
1
vote
1answer
93 views

Generating HMAC(SHA256) keys using WebCrypto deriveKey() API

I am using the javascript WebCrypto API window.crypto.subtle.deriveKey() API to generate HMAC keys like this: ...
0
votes
0answers
99 views

Bitcoin Key Recovery Without Nonce Re-Use

There are a lot of questions in these forums regarding the recovery of private keys. But I'm here to postulate on something unique to a specific piece of research that I looked into recently. The ...
1
vote
0answers
20 views

Is Poly1305 enough for cascading ciphers? [duplicate]

ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
0
votes
1answer
54 views

How do high hash rates affect hashed password security?

Given the increase in hash rate since the rise of numerous block chains, I wonder how this affects the security of many hashed password systems. Is a standard linux ...
0
votes
0answers
33 views

Authentication tag length and post-quantum security

The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
1
vote
0answers
59 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
1
vote
1answer
881 views

Differences between HMAC and HKDF in a specific case

I want to use a key derivation function to derive a key from another one. I think HKDF is the easiest solution in my case. This explanation gives a clear definition of HKDF. In the case where the ...
0
votes
0answers
26 views

Randomizing output of HKDF for the same input key material [duplicate]

Given HKDF and a master input material key $k$, I would like to derive ephemeral keys that cannot be linked together. If I understand correctly, the specification of $HKDF$ adding a unique random $...
3
votes
1answer
128 views

Is HMAC-SHA256 a PRF?

In the abstract of The Exact PRF-Security of NMAC and HMAC, Gazi, Pietrzak, and Rybar state: NMAC was introduced by Bellare, Canetti and Krawczyk [Crypto’96], who proved it to be a secure ...
3
votes
1answer
2k views

Length of truncated HMAC output

RFC 2104 says: Applications of HMAC can choose to truncate the output of HMAC by outputting the t leftmost bits of the HMAC computation for some parameter <...
1
vote
1answer
71 views

What is the best way to forge a tag for a determined message?

Assume a PPT adversary wants to forge a tag for a message. The adversary has oracle access to a verification function. The adversary knows that tags are generated by HMAC-SHA-256 with 128-bit key. I ...
4
votes
1answer
84 views

Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?

As we know, MD5 and SHA1 (to some extent) are broken, and older algorithms like SHA0 or MD4 and MD2 are very broken. Does this also imply that the corresponding HMACs are also broken? Obviously nobody ...
1
vote
1answer
78 views

Is it possible to affect the output of HMAC w/ SHA-512 by providing it with a custom message?

Consider an HMAC algorithm that uses SHA-512 with an unknown private key. Is it possible to affect its output, either partially or totally, by providing it with carefully crafted messages? For the ...
0
votes
1answer
49 views

Is it safe to use the same password/secret for both VeraCrypt volume and its HMAC?

I am trying to script the integrity check of a VeraCrypt volume. ...
0
votes
0answers
46 views

How secure is Encrypt-And-MAC?

From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
2
votes
2answers
291 views

Is E_k(M)||H(m) form of MAC secure?

Would this encryption and signing scenario be considered tamper-proof? ...
1
vote
0answers
29 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
20
votes
2answers
12k views

What size should the HMAC key be with SHA-256?

I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters. What is the ironclad rule ...
3
votes
2answers
94 views

How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?

I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
2
votes
2answers
2k views

HMAC-SHA-512 output randomness?

This is regarding an online roulette game that claims to be fair. Here is the explanation: Two strings are created: STRING1 = "[NONCE]:[SERVER SEED]:[NONCE]" STRING2 = "[NONCE]:[CLIENT ...
4
votes
3answers
548 views

Encrypt-then-MAC with base 64

I've a doubt about the Encrypt-then-MAC approach when using HMAC-SHA-256 with AES-128 in CBC mode, as seen in https://en.wikipedia.org/wiki/Authenticated_encryption. I need to encode the resulting ...
1
vote
1answer
655 views

AES-128 + HMAC-SHA-256 but HMAC truncated

I implemented AES-128 in CBC mode + HMAC-SHA-256 but it seems to me that 256 bit HMAC is more than necessary. Can I truncate the output of HMAC-SHA-256 to a desired bit length? And what is the minimum ...
1
vote
3answers
2k views

Counter based cipher using HMAC-SHA-256

After trying to invent my own AES mode, I decided to just implement something that's known to work, namely CTR mode with HMAC-SHA-256. From what I understand, I can use the IV as a counter, and the ...
0
votes
1answer
233 views

PAN authenticatable irreversible tokenization algorithm

I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets. Is it possible? Is there any standards for that from associations? I was thinking ...
2
votes
3answers
6k views

Key derivation using the main AES encryption key and some plain text?

I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text. I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text ...
-1
votes
1answer
47 views

Encryption on one AES mode and decrypting on another, where both use HMAC

Let's say there are 2 ciphers, $enc$ and $dec$, where: $enc$ will encrypt the data, and $dec$ will decrypt it. Both $enc$ and $dec$ must be an AES cipher. $enc$ and $dec$ will use the same key $k$ ...
0
votes
1answer
243 views

Counters in HOTP

In the HOTP (HMAC-based One-time Password) algorithm the client and the server can have different counter values. Es. if an attacker tries to crack the password with no success. How does HOPT deal ...
2
votes
1answer
69 views

HMAC256(K,m) vs HMAC256(K,K)

I have a key size of 128 bits. My message size is fairly short (e.g., 32 bits - and widely known). Although I am doing a SHA256, the result of the HMAC will be truncated to 128 bits. So my question is:...
1
vote
1answer
59 views

byte significance with hash functions

I am using the python hmac module to generate an authentication code. Given a key, message, and hash function (I am using md5), the library returns an authentication code as a python bytes object. I ...
3
votes
0answers
59 views

Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?

HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function. The hash functions considered in that paper were ones based on the Merkle-...
2
votes
1answer
53 views

Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability? This is what I mean about doing MtEtM: ...
2
votes
0answers
40 views

How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?

I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them. For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...
2
votes
1answer
58 views

Encrypting data with HMAC-SHA1 challenge response as the key

I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data. Generate a non-secret 64 byte random string $M$ (fixed challenge) Generate ...
3
votes
1answer
39 views

Is HKDF one-way, namely given `Ko` it's hard to guess `Ki`?

For background, a HKDF (hmac based key derivation function) takes the form of Ko = KDF(Ki, Label, Context, Len) where Ki is the ...
9
votes
2answers
11k views

How does SafeNet MobilePASS generate passwords?

We use MobilePASS at work but the latest version of the android client seems to be buggy so I wanted to have a go at implementing the algorithm myself. You can download the client to play with here: ...
2
votes
2answers
101 views

Prove that you have the data when hash is public

I am designing an online service where users can upload files (3d models) for processing. I want to speed up things when the same file is uploaded by many different users by allowing them to post a ...
2
votes
1answer
93 views

Is an HMAC based on a second-preimage resistant hash function always unforgeable?

If hash function is collision-resistant, then its associated HMAC is always unforgeable. But suppose that a hash function is only second-preimage resistant, not necessarily collision-resistant. Then ...
2
votes
1answer
46 views

PBKDF2-HMAC Collisions

Trying to understand the well known property of these collisions when used with SHA1, SHA256, etc. where a given key is larger than the block size of the digest function. In these cases the smaller of ...
3
votes
1answer
92 views

Create a TOTP for machines using HMAC or AES

I'm trying to create a sort of Time-based One Time Password (TOTP) where machines are involved (not humans). In this kind of TOTP the step is 15 minutes between one code to the next one and both ...
1
vote
1answer
73 views

Authenticated, Quantum-resistant GPG2?

GPG2 does not provide authentication. It still uses SHA-1 by default. It does not seem to get any stronger as time goes by. If one were to pass a randomly-generated symmetric key (from a TRNG) over ...
-1
votes
2answers
133 views

Does HMAC support or guarantee confidentiality? [closed]

I know that HMAC supports or guarantees both authentication and integrity, but does it also provide confidentiality?
1
vote
2answers
67 views

Break HMAC-SHA256 of PAN with known hash?

Imagine a database containing hashed (HMAC) Primary Account Numbers (PANs ) and associated identifiable information (e.g. transactions). Consider a data breach. Prior to the breach, an attacker made ...
1
vote
1answer
113 views

Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?

Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is: take a secret material which will work as "generator&...
3
votes
2answers
145 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...

1
2 3 4 5
11