Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
54
questions with no upvoted or accepted answers
6
votes
0
answers
302
views
How to make a "zero knowledge" cache/key-value store
I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are:
If the cache ever gets compromised it should reveal nothing about its ids or ...
- 490
4
votes
0
answers
107
views
Which compression functions are MACs?
The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed).
How does this relate to common assumptions for ...
- 4,883
3
votes
1
answer
199
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
3
votes
0
answers
173
views
Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?
HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function.
The hash functions considered in that paper were ones based on the Merkle-...
- 9,001
3
votes
0
answers
154
views
Orignal Krawczyk's HKDF vs latest NIST SP800-56C
I've noticed that the original HKDF in rfc5869 defines a feedback loop. So the pseudo-code is something like:
...
- 131
3
votes
0
answers
205
views
How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?
I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes).
For ...
3
votes
0
answers
45
views
Why does the update algorithm of HMAC_DRBG use two rounds?
I read this paper, which said that $\operatorname{update}(K, V, adin)$ should do two rounds as follows:
$\operatorname{update}(K, V , adin)$:
$K = H(K, V || 0x00 || adin)$
$V = H(K, V )$
If $adin ...
- 31
3
votes
0
answers
686
views
Is there any analysis of freebsd's "geli" encrypted geometry provider?
I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
- 131
3
votes
0
answers
207
views
How does use of HMAC affect hash function combiners?
In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions:
$HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)...
- 1,978
2
votes
0
answers
62
views
key reuse: does knowing H(S) reveal HMAC(S)
given a hash H() , like sha256
and a secret text S
and a public salt P
will knowing H(S) reveal HMAC(P, S) ?
to clarify: the question is if it possible to learn the digest, not the secret.
In my ...
- 121
2
votes
0
answers
53
views
Confused about encapsulation using different types of hash functions
I'm reading Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption. In Section 4 there is a description of encapsulation schemes that says
We suggest an encapsulation ...
- 438
2
votes
0
answers
146
views
How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?
I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them.
For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...
- 9,001
2
votes
0
answers
76
views
Why the salt is used as a key in the extract phase of HKDF?
What is the reason that in the HKDF standard (RFC5869), in the "extract" phase, the 'salt" parameter is instantiated as HMAC key, and the secret keying material 'IKM' is instantiated as HMAC input ...
- 1,066
2
votes
0
answers
91
views
Why is double encryption used to generate EphIDs in DP3T?
The most famous proposed COVID-19 application is DP3T. In this app a user constantly broadcasts EphIDs generated from a secret key as follows:
$$EphID 1 || ... || EphID n = PRG( PRF(SK_t , “broadcast ...
- 21
2
votes
0
answers
40
views
Is there an instance where integrity protecting metadata is bad?
In JWEs there's a unprotected data field as well as recipients are not integrity protected. Is there a case where integrity protecting this data would be a problem? If it doesn't make a difference, ...
2
votes
0
answers
244
views
Is AES CBC + truncated SHA-256 MAC a good design for embedded sensor networks?
I'll start off by saying I'm a noob with respect to software security but I've been reading about security models for a while. Also, I'm afraid some people would just say "go and hire a security ...
- 21
1
vote
0
answers
66
views
Is there a multi-key HMAC scheme?
I wonder if there is any scheme or algorithm to generate HMACs that verify with multiple keys.
Suppose I have the secret keys K1, K2 and K3 and I have a message M1. Is the following possible?
...
1
vote
0
answers
144
views
Quantum-Safe MAC: HMAC and CMAC
If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
- 153
1
vote
0
answers
202
views
Is my TypeScript scrypt implementation using Web Crypto API safe and correct? (Open Source)
I want to use TweetNaCl.js for encrypting user data that is stored in LocalStorage. Therefore, I want to prompt the user to provide a PIN/password that shall be ...
- 111
1
vote
0
answers
41
views
Zero-knowledge data storage with peace of mind. MAC/Encryption with two keys?
Background
Bob's goal: Receive data E = E(D) (encryption of D) from Alice that he knows for sure is encrypted and that he can't possibly decrypt (without brute force). This gives his data backup ...
- 233
1
vote
0
answers
167
views
Is ChaCha20 + HMAC(SHA3) output indistinguishable from randomness?
I was wondering, if the output of following type of ChaCha + HMAC scheme is indistinguishable from randomness:
...
1
vote
0
answers
73
views
is HMAC required if i am using AES-CFB and using Digital signatures for Authentication
I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
1
vote
0
answers
129
views
Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?
The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
- 111
1
vote
0
answers
125
views
What's the difference between H(m) $\oplus$ H(key) and H(m || key) in MAC construction?
We all know that HMAC has the form of $H(ikey || H(okey || M))$. I'm wondering what if we replace the H(okey || M) into H(okey) $\oplus$ H(M)? In other words, is $$H\Big( ikey \mathbin\| \big( H(okey) ...
- 145
1
vote
0
answers
207
views
Forgery of the Carter-Wegman MAC
Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
- 41
1
vote
0
answers
151
views
Schnorr Protocol Implementation - Sometimes Fails on Curve25519
I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
- 145
1
vote
0
answers
35
views
Integrity for mixture of encrypted/unencrypted database fields
I have multiple blobs each (symmetrically) encrypted with its own randomly generated key.
Now I want to encrypt these blob keys with user keys and store them in a database.
A table could have the ...
- 157
1
vote
0
answers
61
views
Security of HMAC against an eavesdropper
Assume we are using HMAC-SHA-256 with 128-bit key for authenticating our messages, and an adversary has eavesdropped $n$ (message, tag) pairs.
If the adversary wants to forge a tag for a message $m'$,...
- 75
1
vote
0
answers
49
views
Yubico’s take on U2F wrapping: purpose of MAC?
I've been reading up on Yubico's implementation of U2F.
I am confused on the purpose of the message authentication code (MAC). It prevents an attacker from providing a key handle (particularly a ...
- 11
1
vote
0
answers
124
views
Tree structure with XTS and HMAC: MAC in parent
Situation:
A file format contains a tree-like data structure; parent nodes can find children and child nodes can also find their (single) parent. To protect confidentiality, the nodes in the file are ...
- 11
1
vote
0
answers
53
views
MAC with key supplied afterwards
Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
- 91.7k
1
vote
0
answers
408
views
How many bits should I use for bearer tokens?
I'm in the process of developing a service that can be accessed with bearer tokens. Currently I'm using a random UUID converted into a URL safe format. That is 128 bits. Users will be authenticated ...
- 113
1
vote
0
answers
239
views
Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?
I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
- 254
1
vote
0
answers
91
views
Rotatable hash-based duplicate check
I want to check duplicates of secret information which is also already encrypted in our database(using ECC algorithm, one of the std curves). plaintexts can be phone numbers, zip codes, etc. Since it'...
- 111
1
vote
0
answers
50
views
HMAC for provable server distributed randomness
I have an application in which a user must use a high-entropy salt to salt a message. Due to the fact that I can not rely on the user to actually provide a strong salt, the server must provide this ...
- 157
1
vote
0
answers
65
views
Keys and key-stretching when authenticating requests?
I'm making a REST application and still a bit confused about this issue. basically, to authenticate incoming requests, I give out userId, issued timestamp, expiry timestamp (normally 3 months after ...
- 11
0
votes
0
answers
95
views
HMAC-SHA256 key length against key recovery attack
I have trouble finding information on the security strength of HMAC-SHA256 against key recovery attacks with respect to the key size.
To fit a certain application I must use a 128-bits key with a HMAC-...
0
votes
0
answers
104
views
Node.js generated JWT secret, nanoid() vs crypto.randomBytes() which is stronger
Which method will generate stronger secret?
64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: ...
0
votes
0
answers
164
views
What is the minimum length of shortened HMAC to be considered safe?
Is it safe to truncate HMAC? What is the minimum length of a truncated HMAC so that HMAC is still considered to be safe to use? Are there any standards on when it comes to shortening HMAC?
In my case, ...
- 101
0
votes
0
answers
65
views
Is it safe to use CTR + HMAC with the same key when the key is unique for each message?
Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
- 101
0
votes
0
answers
226
views
Can a circuit in a zk-SNARK be reversed-engineered?
The definition of zk-SNARK involves not leaking any information from the prover-verifier interaction, but what about leaking information from the circuit itself? e.g., could there be a circuit to ...
- 3
0
votes
0
answers
88
views
0
votes
0
answers
31
views
Has reducing MAC size and increasing message size the same effect on security?
I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
- 101
0
votes
0
answers
402
views
What is the need of xor-ing the key with an outer and inner pad in HMAC?
The diagram above shows the standard HMAC algorithm. However
consider the algorithm of HMAC without xoring the key with outer or inner pad. In other words let the structure of HMAC remain the same ...
- 69
0
votes
0
answers
125
views
Managing master keys used in PBKDF2 and HMAC (store, rotate)
My use case:
I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...).
I use these master keys in two specific ...
- 107
0
votes
0
answers
79
views
Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?
I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
- 1
0
votes
0
answers
955
views
Bitcoin Key Recovery Without Nonce Re-Use
There are a lot of questions in these forums regarding the recovery of private keys.
But I'm here to postulate on something unique to a specific piece of research that I looked into recently.
The ...
- 135
0
votes
0
answers
414
views
How secure is Encrypt-And-MAC?
From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
- 421
0
votes
0
answers
985
views
How to bruteforce password from HMAC-SHA256 hash (if you have the key)?
Short of creating one's own script / program, is there an existing, readily available way of iterating through a list of potential passwords to find which one corresponds to a hash (HMAC-SHA256), ...
- 1
0
votes
0
answers
177
views
Some curiosity about HMAC
Is the probability of distinguishing HMAC from a random oracle is the same as the probability of forging HMAC?
Can we say that the following statement is trivial?
$\Pr[\text{Forging $\operatorname{...
- 75