Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
62 votes
2 answers
19k views

Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?

If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$? However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
Anne Nonimus's user avatar
39 votes
2 answers
59k views

Why is HMAC-SHA1 still considered secure?

This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
user93353's user avatar
  • 2,235
33 votes
2 answers
24k views

Is HMAC-MD5 considered secure for authenticating encrypted data?

I've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash. Does that mean that something like HMAC-MD5 still might be considered ...
Nuoji's user avatar
  • 803
35 votes
2 answers
16k views

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme

Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
Rook's user avatar
  • 1,496
6 votes
2 answers
3k views

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that: The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
kelalaka's user avatar
  • 48.7k
45 votes
2 answers
14k views

What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?

Wikipedia lists the following pseudocode for HMAC: ...
sneak's user avatar
  • 607
26 votes
2 answers
7k views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
hl3mukkel's user avatar
  • 499
25 votes
3 answers
5k views

Is Encrypt+HMAC stronger than AEAD?

There are a few posts that I've come across that seem to imply that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes. https://www.daemonology.net/blog/...
slipheed's user avatar
  • 427
20 votes
2 answers
2k views

Can I use HMAC-SHA1 in counter mode to make a stream cipher?

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ...
xxxxxxxxx's user avatar
  • 558
13 votes
1 answer
2k views

Why does HMAC use two different keys?

Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
abdolahS's user avatar
  • 439
9 votes
2 answers
1k views

Would a HMAC digest make sense in an RSA / ECDSA signature?

When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
Polynomial's user avatar
  • 3,527
8 votes
2 answers
1k views

Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ...
Demi's user avatar
  • 4,793
11 votes
4 answers
2k views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST states ...
NotACryptographer's user avatar
13 votes
2 answers
2k views

How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is $\...
RocketNuts's user avatar
  • 1,387
11 votes
2 answers
4k views

How many trials does it take to break HMAC-MD5?

I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
ladybug's user avatar
  • 213
9 votes
2 answers
2k views

Keys in HMAC and NMAC

I'm quite new to this topic and have several questions concerning HMAC and NMAC: Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
user3142067's user avatar
58 votes
2 answers
73k views

What is the difference between MAC and HMAC?

In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
TheRookierLearner's user avatar
42 votes
4 answers
5k views

Purpose of outer key in HMAC

From what I know, the HMAC constructions has two strength: It's resistant to length extensions Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
CodesInChaos's user avatar
  • 24.9k
36 votes
2 answers
51k views

HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough to ...
Mario's user avatar
  • 361
30 votes
1 answer
4k views

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\...
fgrieu's user avatar
  • 142k
12 votes
1 answer
3k views

For a one-time pad, which MAC method is information-theoretically secure?

In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
lightspeeder's user avatar
11 votes
2 answers
5k views

Is HMAC-MD5 still secure for commitment or other common uses?

MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash ...
mikeazo's user avatar
  • 38.6k
6 votes
1 answer
8k views

SHA256 HMAC brute force with chosen plaintext attacks

This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...
user1373208's user avatar
4 votes
1 answer
871 views

Applications in which you should/shouldn't use a salt with HKDF

rfc5869 has the following to say about the use or lack thereof of salts with HKDF: HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
nohatsatthetable's user avatar
2 votes
4 answers
4k views

How is PBKDF2 so much better than normal Hashing or even using HMAC

I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better ...
C0DEV3IL's user avatar
16 votes
2 answers
2k views

Why is the salt used only once in PBKDF2, while the password is used often?

The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
ericball's user avatar
  • 413
12 votes
4 answers
4k views

Can I determine if a user has the wrong symmetric encryption key?

We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
Barry Wark's user avatar
9 votes
1 answer
3k views

Is HMAC-SHA-1 secure?

Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
BlaX's user avatar
  • 736
2 votes
1 answer
2k views

With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?

Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$? (Assume that $k$ was chosen at random.)
Eugen's user avatar
  • 219
1 vote
2 answers
3k views

Deriving HMAC key and cipher key from passphrase? [duplicate]

I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
Naftuli Kay's user avatar
48 votes
3 answers
41k views

What is the difference between a HMAC and a hash of data?

On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data. What exactly is the difference between an HMAC and a hash of a ...
Naftuli Kay's user avatar
29 votes
6 answers
5k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
matejcik's user avatar
  • 393
28 votes
2 answers
26k views

HMAC vs MAC functions

I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences. What are principle differences? When to use one and when the other?(Typical Use Cases)
Matteo's user avatar
  • 1,131
25 votes
3 answers
20k views

What size should the HMAC key be with SHA-256?

I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters. What is the ironclad rule ...
user30041's user avatar
  • 251
18 votes
1 answer
12k views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
Samee's user avatar
  • 281
14 votes
2 answers
3k views

Encrypt-then-MAC: Do I need to authenticate the IV?

In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?
fadedbee's user avatar
  • 928
14 votes
2 answers
11k views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is PBKDF2-...
Polynomial's user avatar
  • 3,527
12 votes
1 answer
1k views

Why does a broken hash function undermine an HMAC?

For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
Rook's user avatar
  • 1,496
11 votes
2 answers
4k views

Should HMAC-SHA3 be preferred over H(C(k,M))?

If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ...
Maarten Bodewes's user avatar
  • 92.9k
11 votes
1 answer
537 views

Can Skein be used as a secure MAC in format H(k || m)?

Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
user13183's user avatar
  • 145
10 votes
1 answer
5k views

Can I use a HMAC for Replay Attack protection?

I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
err's user avatar
  • 195
8 votes
2 answers
2k views

Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
Anon2000's user avatar
  • 341
7 votes
4 answers
19k views

HMAC with public-private key

I need a way to protect my data. More then encryption I need a way to guarantee integrity and authenticity but I also need to be the only one that can understand integrity and authenticity. I found ...
nkint's user avatar
  • 167
7 votes
1 answer
2k views

Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed: ...
Daan Bakker's user avatar
7 votes
1 answer
2k views

What is the security strength of an n-bit HMAC?

HMACs depend on preimage resistance, or so I have read. The security strength of hash function with an $n$-bit output against collision attacks is $2^{\frac{n}{2}}$. Against preimage attacks, it is $2^...
Melab's user avatar
  • 3,655
7 votes
4 answers
4k views

The difference between MACs vs. HMACs vs. PRFs

I have some confusion regarding the difference between MACs and HMACs and PRFs and when to use which term. If the function is computed using a hash and secret key like the following, is this a HMAC ...
user6875880's user avatar
6 votes
1 answer
942 views

HKDF randomness extraction - salt or no salt?

According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction. This question is solely about the necessity of a salt for the purposes of randomness ...
knaccc's user avatar
  • 4,732
5 votes
1 answer
703 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ is a nonce $m$...
Tim McLean's user avatar
  • 2,844
5 votes
1 answer
574 views

Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?

As we know, MD5 and SHA1 (to some extent) are broken, and older algorithms like SHA0 or MD4 and MD2 are very broken. Does this also imply that the corresponding HMACs are also broken? Obviously nobody ...
RocketNuts's user avatar
  • 1,387
4 votes
1 answer
1k views

Is HMAC prone to birthday attacks?

Popular attacks on cryptographic hash algorithms are "birthday attacks" . At high level , if a hash function produces $n$ bits of output, an attacker who computes only $2^{n/2}$ hash operations on ...
sashank's user avatar
  • 6,194