Skip to main content

Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
1 vote
2 answers
89 views

Why does HMAC-SHA1-96 need to pad message to a multiple of 160 bits?

HMAC-SHA1-96 is performed in AH of IPSec, to have data authentication and integrity. I don't understand why I need to pad message M to a multiple of 160 bit, which is the output length of SHA1. Why is ...
allexj's user avatar
  • 51
3 votes
2 answers
123 views

How can a attacker find a collision of a keyed digest without knowing the key? Are collisions not an issue anymore if we apply a keyed-digest?

Same as the title. How can an attacker find a collision in a keyed digest without knowing the key? Does using a keyed digest eliminate the problem of collisions?
allexj's user avatar
  • 51
0 votes
0 answers
45 views

Peer-to-Peer message verification

I have a chat application that uses AES and RSA encryption to establish a peer-to-peer connection between two clients. Although the messages pass through a server, they are encrypted using a single ...
Higgs's user avatar
  • 1
0 votes
1 answer
44 views

HMAC on a public key verfied data: how secure it is?

I wonder how secure the HMAC is going to be if I use a public key verified data. HMAC suggests its key must be secret. I want to authenticate a set of blocks to be certain that each of them isn't ...
Mikhail Sobolev's user avatar
0 votes
2 answers
70 views

New Service to Service Protocol Presented for Public Scrutiny (Time-based Token Signing), Is it Safe?

I came up with the following protocol to provide a life-time for JWT tokens while differentiating services to communicate securely with web services (service-to-service) using symmetric key signing ...
Adam Memisyazici's user avatar
2 votes
2 answers
199 views

Trying to hash a password using salt for the first time

I'm trying to hash (as secure as resonably possible) a password inside my db. Per user I have their email, username and password and a uuid4 to identify them. And for the password I though of using ...
SH4DOW4RE's user avatar
0 votes
0 answers
82 views

What is the simplest method of protecting a one time pad encrypted message from bit flip attacks?

I'm building a micro-controller based encryption device that uses one time pads. System details The reason I'm going this route is that I want a system which secure, but also very simple and easy to ...
Drew's user avatar
  • 141
1 vote
0 answers
192 views

Help with HMAC Known plaintext / mac puzzle

Finally caving and asking for help...I'm not in the field, just doing random CTF challenges to learn more and I've really been enjoying it in general. However, I'm totally stuck on this puzzle at the ...
Heath's user avatar
  • 13
2 votes
1 answer
132 views

Is it safe to "sign" a message with such a zk proof

I am building an application in which I need to sign a message without revealing my entire identity. To do so, I just compute a zk proof with the following purpose: prove I own the secret key sk ...
Makubu's user avatar
  • 21
0 votes
2 answers
70 views

Can the secret and the message be switched in a mac? [duplicate]

A HMAC is usually said to be H(sk || msg) for some secret key sk and message msg. My first question is, can we compute it as H(msg || sk) instead ? Is there any drawbacks doing it ? If the answer is ...
Makubu's user avatar
  • 21
1 vote
1 answer
155 views

What does "192-bit equivalent" mean for WPA3?

In the Wikipedia page for WPA3 enterprise mode, it states that WPA3 has an "...equivalent 192-bit cryptographic strength in WPA3-Enterprise mode..." yet it also says that it uses AES-256-GCM ...
Maxthecat's user avatar
  • 111
0 votes
0 answers
48 views

Using AEAD as pure MAC with *only* associated data? [duplicate]

Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
pogoya9172's user avatar
0 votes
0 answers
226 views

HMAC-SHA256 key length against key recovery attack

I have trouble finding information on the security strength of HMAC-SHA256 against key recovery attacks with respect to the key size. To fit a certain application I must use a 128-bits key with a HMAC-...
dragonfire2000's user avatar
0 votes
1 answer
97 views

KangarooTwelve based Random-Access PRNG

Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
Ilan's user avatar
  • 1
1 vote
1 answer
317 views

Safe to use a BCrypt hash directly as a key to HMAC-SHA256?

Is it safe (or optimal) to use a BCrypt hash directly as the key to an HMAC-SHA256? I ask because all the BCrypt hashes I will use contain the same salt, version, and cost, so the first 29 characters ...
Starscream512's user avatar
0 votes
0 answers
196 views

Node.js generated JWT secret, nanoid() vs crypto.randomBytes() which is stronger

Which method will generate stronger secret? 64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: ...
wefad12292's user avatar
2 votes
1 answer
1k views

HMAC SHA256 walkthrough examples

I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully). I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc). Does anyone know of any ...
intrigued_66's user avatar
3 votes
1 answer
237 views

Does PBKDF2 HMAC 512 really only produce a maximum of ~128 bits of entropy? Regardless of input?

Andreas Antonopoulos effectively states: an input of 256bits of entropy into PBKDF2-HMAC-SHA512 will ONLY output a 64 byte hash containing ~128 bits of entropy. He states the algorithm essentially ...
George's user avatar
  • 33
3 votes
1 answer
219 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
3 votes
1 answer
144 views

Verify HMAC tag without knowing the key

Let's say there's Alice and Bob. Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$. Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
tock203's user avatar
  • 345
0 votes
1 answer
57 views

Why is IV in RFC8448 examples only 12 octets instead of 16?

I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
miran80's user avatar
  • 123
2 votes
1 answer
1k views

When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?

When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used), should we use SHA-...
SeekingAnswers's user avatar
1 vote
0 answers
75 views

Is there a multi-key HMAC scheme?

I wonder if there is any scheme or algorithm to generate HMACs that verify with multiple keys. Suppose I have the secret keys K1, K2 and K3 and I have a message M1. Is the following possible? ...
Different-March-5530's user avatar
2 votes
1 answer
121 views

Does having more than one HMAC provide more information to the attacker?

Suppose $N$ many messages has been sent from $A$ to $B$ in this format: $\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$. Where $C(i)$ is some cipher-text encrypted with some secure algorithm using ...
CuriousCrypto's user avatar
2 votes
2 answers
436 views

Why do we encrypt then decrypt then encrypt data with different keys?

In GlobalPlatform specification for smartcards, I came accross this rather strange scheme* ISO/IEC ISO/IEC 9797-1 MAC Algorithm 3: To calculate the Message Authentication Code, we take some original ...
Ryan B.'s user avatar
  • 153
1 vote
0 answers
187 views

Quantum-Safe MAC: HMAC and CMAC

If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
bilaljo's user avatar
  • 163
3 votes
1 answer
262 views

Security of using key size larger than the message digest size in HMAC, with one time pads

I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption. One time pads for the message and the key of HMAC are ...
CuriousCrypto's user avatar
-1 votes
1 answer
101 views

Can I use many iterations of HMAC function instead of PBKDF2?

I know, that PBKDF2 uses HMAC with SHA2 function as PRF. But.. can I use many iterations of HMAC with SHA2 directly? Is this effective and securely? P.S I need the best function, but I can’t use ...
Murrchalkina's user avatar
1 vote
0 answers
338 views

Is my TypeScript scrypt implementation using Web Crypto API safe and correct? (Open Source)

I want to use TweetNaCl.js for encrypting user data that is stored in LocalStorage. Therefore, I want to prompt the user to provide a PIN/password that shall be ...
kyr0's user avatar
  • 111
3 votes
1 answer
145 views

Signal's Key Wrap: is it safe and is it custom?

The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV. It's used to encrypt your master key with your ...
Tim Shadel's user avatar
0 votes
1 answer
56 views

Replace checksum with asymetric hash

The purpose is for a server to ensure the content of the flash memory of a slave IoT contains a good known firmware. The server does not have a copy of the IoT firmware code - but only a hash or ...
Adarwoo's user avatar
2 votes
1 answer
1k views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
LUMPAAK's user avatar
  • 21
1 vote
1 answer
154 views

Is there any point in extending an 80-bit key before using it for HMAC-SHA256?

I have been asked to make a HMAC-SHA256 password digest from: a password some salt, and an 80-bit secret key. I've been advised that I should be using a key of 256 bits or more for HMAC-256. The key ...
fadedbee's user avatar
  • 938
1 vote
0 answers
41 views

Zero-knowledge data storage with peace of mind. MAC/Encryption with two keys?

Background Bob's goal: Receive data E = E(D) (encryption of D) from Alice that he knows for sure is encrypted and that he can't possibly decrypt (without brute force). This gives his data backup ...
cryptonamus's user avatar
2 votes
1 answer
304 views

Generic attack on Hmac sha256

Is there any generic attack on HMAC SHA 256 ? I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
Donnie's user avatar
  • 33
-1 votes
2 answers
1k views

Can I 100% trust the PBKDF2(HMAC-SHA256) AES-256 CBC encryption algorithm for file encryption purposes or not, and why? (Winrar) [closed]

I am not an expert in cryptography and therefore I would like to address this problem to people who have been working on this topic for a long time and thus verify the facts from several sources. I ...
Hasbo's user avatar
  • 13
0 votes
1 answer
130 views

Is it insecure to make HMAC SHA1 message and corresponding hash public?

Not sure about the security implications of making HMAC SHA1 message and corresponding hash public (secret would remain… secret)? Evaluating if that would help an attacker crack algorithm.
sunknudsen's user avatar
1 vote
1 answer
2k views

Is HMAC SHA1 algorithm secure in 2022? [duplicate]

Contemplating using YubiKey’s challenge-response feature to hash public passphrases. By public, I mean an attacker could potentially exfiltrate passphrases but, not having YubiKey*, passphrases would ...
sunknudsen's user avatar
3 votes
1 answer
117 views

Avoid hash flooding without a secret key?

I'm currently building an implementation of the dynamo paper, yottastore. Imagine it as a huge, distributed, hash map. To find the node holding a key, I use rendezvous hashing (an improvement over ...
Mascarpone's user avatar
0 votes
1 answer
279 views

HMAC-MD5 or truncated HMAC-SHA512

I'm creating an application that requires message authentication on the payload of a QR-code. Because of the maximum length of an error-correcting (H) QR-code (368 bits) and the original size of my ...
Rien Bijl's user avatar
0 votes
0 answers
298 views

What is the minimum length of shortened HMAC to be considered safe?

Is it safe to truncate HMAC? What is the minimum length of a truncated HMAC so that HMAC is still considered to be safe to use? Are there any standards on when it comes to shortening HMAC? In my case, ...
g00dds's user avatar
  • 101
0 votes
0 answers
92 views

Is it safe to use CTR + HMAC with the same key when the key is unique for each message?

Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
g00dds's user avatar
  • 101
1 vote
0 answers
214 views

Is ChaCha20 + HMAC(SHA3) output indistinguishable from randomness?

I was wondering, if the output of following type of ChaCha + HMAC scheme is indistinguishable from randomness: ...
The amateur programmer's user avatar
2 votes
2 answers
483 views

How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
Kibnakamoto's user avatar
1 vote
0 answers
89 views

is HMAC required if i am using AES-CFB and using Digital signatures for Authentication

I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
ANISH M 18CS006's user avatar
3 votes
1 answer
601 views

NIST expression for HMAC security strength

In NIST SP800-107, NIST claims that the security strength of HMAC is MIN(security of HMAC key, $2L$). $L$ is the length of the output of the underlying hash function. Let's take HMAC-SHA256 as an ...
Evgeni Vaknin's user avatar
1 vote
1 answer
264 views

Can asymmetric encryption be used in HMAC, and still ensure the data has not been tampered with? [closed]

Suppose I want to send a message, but not privately; I want everybody to see it, even an attacker in the middle. I would do this by appending a public key to the start of the data, which could be used ...
jw01a's user avatar
  • 11
5 votes
2 answers
5k views

Is HMAC part of the TLS/SSL process?

Does HMAC take part in TLS/SSL? When the client and the server pass the TLS handshake and create a common SESSION key, do they also HMAC each message that is being sent out for the purpose of data ...
Aleksandar Stefanov's user avatar
1 vote
1 answer
190 views

Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?

Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
Paul Uszak's user avatar
  • 15.6k
1 vote
2 answers
322 views

Why does the RFC version of HKDF-Expand start the counter at 1?

In RFC 5869, the definition of HKDF-Expand is given as follows, with the terminating counter value ranging from 1 to (presumably) 255: ...
Neil Madden's user avatar

1
2 3 4 5
13