Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
620
questions
-1
votes
0
answers
23
views
Are there any obvious vulnerabilities/flaws in my secure communications scheme, specifically in the way I use sequence numbers in messages? [closed]
Sorry, this is a long question, but I wanted to give proper background.
QUESTION:
Are there any obvious vulnerabilities/flaws in my secure communications scheme. Most specifically I want to find ...
- 131
0
votes
0
answers
48
views
Using AEAD as pure MAC with *only* associated data? [duplicate]
Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
0
votes
1
answer
63
views
KangarooTwelve based Random-Access PRNG
Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
CommunityBot
- 1
0
votes
0
answers
95
views
HMAC-SHA256 key length against key recovery attack
I have trouble finding information on the security strength of HMAC-SHA256 against key recovery attacks with respect to the key size.
To fit a certain application I must use a 128-bits key with a HMAC-...
1
vote
1
answer
118
views
Safe to use a BCrypt hash directly as a key to HMAC-SHA256?
Is it safe (or optimal) to use a BCrypt hash directly as the key to an HMAC-SHA256? I ask because all the BCrypt hashes I will use contain the same salt, version, and cost, so the first 29 characters ...
CommunityBot
- 1
24
votes
3
answers
17k
views
What size should the HMAC key be with SHA-256?
I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters.
What is the ironclad rule ...
- 138k
3
votes
1
answer
199
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
CommunityBot
- 1
0
votes
0
answers
104
views
Node.js generated JWT secret, nanoid() vs crypto.randomBytes() which is stronger
Which method will generate stronger secret?
64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: ...
2
votes
1
answer
257
views
HMAC SHA256 walkthrough examples
I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully).
I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc).
Does anyone know of any ...
- 123
3
votes
1
answer
175
views
Does PBKDF2 HMAC 512 really only produce a maximum of ~128 bits of entropy? Regardless of input?
Andreas Antonopoulos effectively states: an input of 256bits of entropy into PBKDF2-HMAC-SHA512 will ONLY output a 64 byte hash containing ~128 bits of entropy. He states the algorithm essentially ...
- 138k
3
votes
1
answer
147
views
Does HMAC provide anything that AES GCM does not?
I would like to let the receiver has the ability to check the sender's authenticity when he gets the message.
Also, I want to protect the message's confidentiality and integrity.
Should I use ...
- 145k
3
votes
1
answer
98
views
Verify HMAC tag without knowing the key
Let's say there's Alice and Bob.
Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$.
Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
- 1,701
0
votes
1
answer
46
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
- 145k
2
votes
1
answer
626
views
When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?
When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used),
should we use SHA-...
1
vote
0
answers
66
views
Is there a multi-key HMAC scheme?
I wonder if there is any scheme or algorithm to generate HMACs that verify with multiple keys.
Suppose I have the secret keys K1, K2 and K3 and I have a message M1. Is the following possible?
...
2
votes
1
answer
95
views
Does having more than one HMAC provide more information to the attacker?
Suppose $N$ many messages has been sent from $A$ to $B$ in this format:
$\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$.
Where
$C(i)$ is some cipher-text encrypted with some secure algorithm using ...
- 138k
2
votes
2
answers
314
views
Why do we encrypt then decrypt then encrypt data with different keys?
In GlobalPlatform specification for smartcards, I came accross this rather strange scheme* ISO/IEC ISO/IEC 9797-1 MAC Algorithm 3:
To calculate the Message Authentication Code, we take some original ...
- 153
1
vote
0
answers
144
views
Quantum-Safe MAC: HMAC and CMAC
If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
- 153
-1
votes
1
answer
92
views
Can I use many iterations of HMAC function instead of PBKDF2?
I know, that PBKDF2 uses HMAC with SHA2 function as PRF. But.. can I use many iterations of HMAC with SHA2 directly? Is this effective and securely? P.S I need the best function, but I can’t use ...
- 11.7k
1
vote
0
answers
202
views
Is my TypeScript scrypt implementation using Web Crypto API safe and correct? (Open Source)
I want to use TweetNaCl.js for encrypting user data that is stored in LocalStorage. Therefore, I want to prompt the user to provide a PIN/password that shall be ...
- 111
0
votes
0
answers
21
views
finding the Key if hmac output, and input are known [duplicate]
Assume we have message M, key K, and MAC = hmac-256SHA(M, K).
I wonder if an attacker can figure out the Key K if the attacker knows the Message M and MAC
- 1
1
vote
2
answers
351
views
PAN authenticatable irreversible tokenization algorithm
I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets.
Is it possible? Is there any standards for that from associations?
I was thinking ...
CommunityBot
- 1
3
votes
1
answer
113
views
Signal's Key Wrap: is it safe and is it custom?
The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV.
It's used to encrypt your master key with your ...
- 161
0
votes
1
answer
54
views
Replace checksum with asymetric hash
The purpose is for a server to ensure the content of the flash memory of a slave IoT contains a good known firmware.
The server does not have a copy of the IoT firmware code - but only a hash or ...
- 145k
2
votes
1
answer
573
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 91.7k
1
vote
1
answer
88
views
Is there any point in extending an 80-bit key before using it for HMAC-SHA256?
I have been asked to make a HMAC-SHA256 password digest from:
a password
some salt, and
an 80-bit secret key.
I've been advised that I should be using a key of 256 bits or more for HMAC-256.
The key ...
- 91.7k
1
vote
0
answers
41
views
Zero-knowledge data storage with peace of mind. MAC/Encryption with two keys?
Background
Bob's goal: Receive data E = E(D) (encryption of D) from Alice that he knows for sure is encrypted and that he can't possibly decrypt (without brute force). This gives his data backup ...
- 233
2
votes
2
answers
435
views
Is there any good attack model of HMAC?
Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
CommunityBot
- 1
8
votes
4
answers
1k
views
Could a 6502 CPU safely compute a SHA-1 hash in a reasonable length of time?
The 6502 is the CPU in a Tamagotchi (which can be hacked to run custom code). SHA-1 is the default hash used for TOTP (the algorithm used by two-factor authentication tokens and apps). Hopefully you ...
- 138k
10
votes
1
answer
5k
views
Can I use a HMAC for Replay Attack protection?
I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
CommunityBot
- 1
38
votes
2
answers
57k
views
Why is HMAC-SHA1 still considered secure?
This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family
says that the security of HMAC-SHA1 does not depend on resistance to ...
- 138k
2
votes
1
answer
288
views
AES-128/CTR/NoPadding HMAC vs Signature
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
- 47.6k
3
votes
1
answer
99
views
Avoid hash flooding without a secret key?
I'm currently building an implementation of the dynamo paper, yottastore. Imagine it as a huge, distributed, hash map.
To find the node holding a key, I use rendezvous hashing (an improvement over ...
2
votes
1
answer
214
views
Generic attack on Hmac sha256
Is there any generic attack on HMAC SHA 256 ?
I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
- 5,786
-1
votes
2
answers
748
views
Can I 100% trust the PBKDF2(HMAC-SHA256) AES-256 CBC encryption algorithm for file encryption purposes or not, and why? (Winrar) [closed]
I am not an expert in cryptography and therefore I would like to address this problem to people who have been working on this topic for a long time and thus verify the facts from several sources.
I ...
- 47.6k
0
votes
1
answer
113
views
Is it insecure to make HMAC SHA1 message and corresponding hash public?
Not sure about the security implications of making HMAC SHA1 message and corresponding hash public (secret would remain… secret)?
Evaluating if that would help an attacker crack algorithm.
- 91.7k
0
votes
1
answer
1k
views
Is HMAC SHA1 algorithm secure in 2022? [duplicate]
Contemplating using YubiKey’s challenge-response feature to hash public passphrases.
By public, I mean an attacker could potentially exfiltrate passphrases but, not having YubiKey*, passphrases would ...
- 2,023
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
- 15.1k
0
votes
1
answer
179
views
HMAC-MD5 or truncated HMAC-SHA512
I'm creating an application that requires message authentication on the payload of a QR-code. Because of the maximum length of an error-correcting (H) QR-code (368 bits) and the original size of my ...
- 1,587
0
votes
0
answers
164
views
What is the minimum length of shortened HMAC to be considered safe?
Is it safe to truncate HMAC? What is the minimum length of a truncated HMAC so that HMAC is still considered to be safe to use? Are there any standards on when it comes to shortening HMAC?
In my case, ...
- 91.7k
0
votes
0
answers
65
views
Is it safe to use CTR + HMAC with the same key when the key is unique for each message?
Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
- 101
1
vote
0
answers
167
views
Is ChaCha20 + HMAC(SHA3) output indistinguishable from randomness?
I was wondering, if the output of following type of ChaCha + HMAC scheme is indistinguishable from randomness:
...
2
votes
2
answers
154
views
How to compose multiple values to MAC authenticate?
If the data I want to authenticate consists of multiple values and I compute a MAC simply concatenating the values, an adversary can "shift" characters within those values without ...
- 2,695
1
vote
2
answers
298
views
Why does the RFC version of HKDF-Expand start the counter at 1?
In RFC 5869, the definition of HKDF-Expand is given as follows, with the terminating counter value ranging from 1 to (presumably) 255:
...
- 43
2
votes
2
answers
352
views
How does the ECIES-AES encryption work with a key size that is not supported by AES?
I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
- 6,289
2
votes
4
answers
593
views
Encrypt-then-MAC: full random keys or keys derived from master key?
I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better:
Use the CSPRNG ...
- 1,587
1
vote
0
answers
73
views
is HMAC required if i am using AES-CFB and using Digital signatures for Authentication
I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
3
votes
1
answer
468
views
NIST expression for HMAC security strength
In NIST SP800-107, NIST claims that the security strength of HMAC is MIN(security of HMAC key, $2L$). $L$ is the length of the output of the underlying hash function. Let's take HMAC-SHA256 as an ...
- 21.9k
3
votes
1
answer
355
views
Encrypt-then-HMAC with a single key is secure?
The partition oracle attacks exploits the non-committing AEAD schemes.
Informally, a committing encryption scheme is one for which it is computationally intractable to find a pair of keys and a ...
- 1,587
25
votes
3
answers
5k
views
Is Encrypt+HMAC stronger than AEAD?
There are a few posts that I've come across that seem to imply that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes.
https://www.daemonology.net/blog/...
- 1,587