Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
120
questions
60
votes
2
answers
19k
views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
- 703
38
votes
2
answers
57k
views
Why is HMAC-SHA1 still considered secure?
This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family
says that the security of HMAC-SHA1 does not depend on resistance to ...
- 2,179
33
votes
2
answers
24k
views
Is HMAC-MD5 considered secure for authenticating encrypted data?
I've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash.
Does that mean that something like HMAC-MD5 still might be considered ...
- 803
34
votes
2
answers
16k
views
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme
Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme?
Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
- 1,486
6
votes
2
answers
3k
views
GMAC vs HMAC in message forgery and bandwidth
Saarinen in his work GCM, GHASH and Weak Keys says that:
The GHASH algorithm belongs to a widely studied class of Wegman-Carter
polynomial universal hashes. The security bounds known (this and ...
- 47.6k
46
votes
2
answers
14k
views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
- 617
26
votes
2
answers
7k
views
Is HMAC needed for a SHA-3 based MAC?
HMAC does nested hashing in order to prevent Length Extension Attacks.
Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
- 499
25
votes
3
answers
5k
views
Is Encrypt+HMAC stronger than AEAD?
There are a few posts that I've come across that seem to imply that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes.
https://www.daemonology.net/blog/...
- 427
13
votes
1
answer
2k
views
Why does HMAC use two different keys?
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?
See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
- 429
19
votes
2
answers
2k
views
Can I use HMAC-SHA1 in counter mode to make a stream cipher?
Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey).
Would it be secure to feed it like a block cipher in counter mode to get a ...
- 538
9
votes
2
answers
1k
views
Would a HMAC digest make sense in an RSA / ECDSA signature?
When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
- 3,527
8
votes
2
answers
1k
views
Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?
I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ...
- 4,763
11
votes
4
answers
2k
views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST states ...
13
votes
2
answers
2k
views
How is HMAC(message,key) more secure than Hash(key1+message+key2)
I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction.
What I don't understand is, how or why is $\...
- 1,397
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
- 213
9
votes
2
answers
2k
views
Keys in HMAC and NMAC
I'm quite new to this topic and have several questions concerning HMAC and NMAC:
Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
- 193
57
votes
2
answers
70k
views
What is the difference between MAC and HMAC?
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
41
votes
4
answers
5k
views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
- 24.8k
35
votes
2
answers
50k
views
HMAC-SHA1 vs HMAC-SHA256
I have three questions:
Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication?
How much HMAC-SHA256 is slower than HMAC-SHA1?
Are the security improvements of SHA256 (over SHA1) enough to ...
- 351
30
votes
1
answer
4k
views
How secure would HMAC-SHA3 be?
It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\...
- 138k
12
votes
1
answer
3k
views
For a one-time pad, which MAC method is information-theoretically secure?
In the the main post about MAC methods it mentions a few methods:
Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
- 368
11
votes
2
answers
5k
views
Is HMAC-MD5 still secure for commitment or other common uses?
MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash ...
- 38.5k
6
votes
1
answer
8k
views
SHA256 HMAC brute force with chosen plaintext attacks
This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key
I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...
- 71
4
votes
1
answer
582
views
Applications in which you should/shouldn't use a salt with HKDF
rfc5869 has the following to say about the use or lack thereof of salts with HKDF:
HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
2
votes
4
answers
4k
views
How is PBKDF2 so much better than normal Hashing or even using HMAC
I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better ...
- 19
16
votes
2
answers
2k
views
Why is the salt used only once in PBKDF2, while the password is used often?
The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
- 413
12
votes
4
answers
3k
views
Can I determine if a user has the wrong symmetric encryption key?
We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
- 223
9
votes
1
answer
3k
views
Is HMAC-SHA-1 secure?
Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
- 736
1
vote
2
answers
3k
views
Deriving HMAC key and cipher key from passphrase? [duplicate]
I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
- 967
1
vote
1
answer
2k
views
With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$? (Assume that $k$ was chosen at random.)
- 209
48
votes
3
answers
40k
views
What is the difference between a HMAC and a hash of data?
On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.
What exactly is the difference between an HMAC and a hash of a ...
- 967
28
votes
6
answers
5k
views
Why not authenticate full-disk encryption?
Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
- 383
28
votes
2
answers
26k
views
HMAC vs MAC functions
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.
What are principle differences?
When to use one and when the other?(Typical Use Cases)
- 1,131
24
votes
3
answers
17k
views
What size should the HMAC key be with SHA-256?
I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters.
What is the ironclad rule ...
- 241
18
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
- 281
14
votes
2
answers
11k
views
Is PBKDF2-HMAC-SHA1 really broken?
I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions.
Am I missing something here? Is PBKDF2-...
- 3,527
13
votes
2
answers
3k
views
Encrypt-then-MAC: Do I need to authenticate the IV?
In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?
- 897
12
votes
1
answer
1k
views
Why does a broken hash function undermine an HMAC?
For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
- 1,486
11
votes
2
answers
4k
views
Should HMAC-SHA3 be preferred over H(C(k,M))?
If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC.
...
- 91.9k
11
votes
1
answer
526
views
Can Skein be used as a secure MAC in format H(k || m)?
Can Skein be used as a secure MAC in format H(k || m)?
I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
- 145
10
votes
1
answer
5k
views
Can I use a HMAC for Replay Attack protection?
I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
- 195
8
votes
2
answers
2k
views
Is the HMAC construction really neccessary for a fixed length message?
The HMAC Construction is defined as:
Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) )
This was designed because a simpler construction such as:
...
- 341
7
votes
4
answers
4k
views
The difference between MACs vs. HMACs vs. PRFs
I have some confusion regarding the difference between MACs and HMACs and PRFs and when to use which term.
If the function is computed using a hash and secret key like the following, is this a HMAC ...
- 503
7
votes
1
answer
2k
views
Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?
I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed:
...
- 490
7
votes
4
answers
18k
views
HMAC with public-private key
I need a way to protect my data.
More then encryption I need a way to guarantee integrity and authenticity but I also need to be the only one that can understand integrity and authenticity.
I found ...
- 167
7
votes
1
answer
2k
views
What is the security strength of an n-bit HMAC?
HMACs depend on preimage resistance, or so I have read. The security strength of hash function with an $n$-bit output against collision attacks is $2^{\frac{n}{2}}$. Against preimage attacks, it is $2^...
- 3,645
6
votes
1
answer
745
views
HKDF randomness extraction - salt or no salt?
According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction.
This question is solely about the necessity of a salt for the purposes of randomness ...
- 4,712
5
votes
1
answer
682
views
Using HMAC as a nonce with AES-CTR encrypt-and-MAC
Suppose I use the following encrypt-and-MAC construction:
$E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where:
$k_1$ and $k_2$ are 256-bit keys
$n$ is a nonce
$m$...
- 2,824
5
votes
1
answer
481
views
Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?
As we know, MD5 and SHA1 (to some extent) are broken, and older algorithms like SHA0 or MD4 and MD2 are very broken.
Does this also imply that the corresponding HMACs are also broken?
Obviously nobody ...
- 1,397
3
votes
1
answer
1k
views
Should HMAC or NMAC or plain Keccak be used for a secure MAC?
After some digging around in the HMAC spec I found this (paraphrased):
Step 1: If the length of Key equals the block size of the hash
function (512 bits/64 Bytes for SHA-256), set the key equal ...
- 145