Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
621
questions
60
votes
2
answers
19k
views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
- 703
57
votes
2
answers
70k
views
What is the difference between MAC and HMAC?
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
48
votes
3
answers
40k
views
What is the difference between a HMAC and a hash of data?
On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.
What exactly is the difference between an HMAC and a hash of a ...
- 967
46
votes
2
answers
14k
views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
- 617
41
votes
4
answers
5k
views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
- 24.8k
38
votes
2
answers
57k
views
Why is HMAC-SHA1 still considered secure?
This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family
says that the security of HMAC-SHA1 does not depend on resistance to ...
- 2,179
35
votes
2
answers
16k
views
HMAC vs ECDSA for JWT
I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
- 453
35
votes
2
answers
50k
views
HMAC-SHA1 vs HMAC-SHA256
I have three questions:
Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication?
How much HMAC-SHA256 is slower than HMAC-SHA1?
Are the security improvements of SHA256 (over SHA1) enough to ...
- 351
35
votes
0
answers
48k
views
Key size for HMAC-SHA256 [duplicate]
After reading a bunch of past stack exchange posts like this one and RFCs 5869, 2104, and 4868 I felt comfortable that a 32-byte key was sufficient for HMAC-SHA256. However, I am implementing my code ...
- 553
34
votes
2
answers
16k
views
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme
Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme?
Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
- 1,486
33
votes
2
answers
24k
views
Is HMAC-MD5 considered secure for authenticating encrypted data?
I've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash.
Does that mean that something like HMAC-MD5 still might be considered ...
- 803
30
votes
1
answer
4k
views
How secure would HMAC-SHA3 be?
It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\...
- 138k
28
votes
6
answers
5k
views
Why not authenticate full-disk encryption?
Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
- 383
28
votes
2
answers
26k
views
HMAC vs MAC functions
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.
What are principle differences?
When to use one and when the other?(Typical Use Cases)
- 1,131
27
votes
1
answer
24k
views
Use cases for CMAC vs. HMAC?
Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is ...
- 356
26
votes
2
answers
7k
views
Is HMAC needed for a SHA-3 based MAC?
HMAC does nested hashing in order to prevent Length Extension Attacks.
Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
- 499
25
votes
3
answers
5k
views
Is Encrypt+HMAC stronger than AEAD?
There are a few posts that I've come across that seem to imply that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes.
https://www.daemonology.net/blog/...
- 427
24
votes
3
answers
17k
views
What size should the HMAC key be with SHA-256?
I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters.
What is the ironclad rule ...
- 241
19
votes
1
answer
31k
views
HMAC SHA256 vs RSA SHA256 - which one to use
Salesforce recently announced they are moving away from HMAC SHA256 to RSA SHA256.
Why did they make that move? Any technical ...
- 293
19
votes
2
answers
2k
views
Can I use HMAC-SHA1 in counter mode to make a stream cipher?
Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey).
Would it be secure to feed it like a block cipher in counter mode to get a ...
- 538
18
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
- 281
16
votes
2
answers
2k
views
Why is the salt used only once in PBKDF2, while the password is used often?
The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
- 413
15
votes
1
answer
2k
views
Security of N bit HMAC
Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?
- 451
15
votes
1
answer
10k
views
How does the secret key in an HMAC prevent modification of the HMAC?
Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course.
When using Hash-based message authentication codes, I understand that ...
user11184
14
votes
2
answers
11k
views
Is PBKDF2-HMAC-SHA1 really broken?
I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions.
Am I missing something here? Is PBKDF2-...
- 3,527
13
votes
2
answers
3k
views
Encrypt-then-MAC: Do I need to authenticate the IV?
In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?
- 897
13
votes
1
answer
2k
views
Why does HMAC use two different keys?
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?
See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
- 429
13
votes
2
answers
2k
views
How is HMAC(message,key) more secure than Hash(key1+message+key2)
I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction.
What I don't understand is, how or why is $\...
- 1,397
12
votes
4
answers
3k
views
Can I determine if a user has the wrong symmetric encryption key?
We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
- 223
12
votes
1
answer
1k
views
Why does a broken hash function undermine an HMAC?
For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
- 1,486
12
votes
2
answers
11k
views
What are advantages of using a HMAC over RSA with SHA-1 hashes?
I am currently studying for an exam and this was a previous question:
Give one advantage of using HMACs over using RSA to sign SHA-1 hashes.
My thoughts are that it has something to do with the ...
- 223
12
votes
3
answers
9k
views
How does AWS Secret key and access key work
Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client?
My guess is:
AWS access key ID is a form of unique user/account identifier
AWS ...
- 351
12
votes
1
answer
3k
views
For a one-time pad, which MAC method is information-theoretically secure?
In the the main post about MAC methods it mentions a few methods:
Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
- 368
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
- 213
11
votes
1
answer
526
views
Can Skein be used as a secure MAC in format H(k || m)?
Can Skein be used as a secure MAC in format H(k || m)?
I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
- 145
11
votes
2
answers
4k
views
Should HMAC-SHA3 be preferred over H(C(k,M))?
If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC.
...
- 91.9k
11
votes
4
answers
2k
views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST states ...
11
votes
2
answers
5k
views
Is HMAC-MD5 still secure for commitment or other common uses?
MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash ...
- 38.5k
11
votes
1
answer
3k
views
Regular MACs vs Carter-Wegman MAC
Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc).
...
- 736
11
votes
1
answer
682
views
Can someone clarify two things about the HKDF by Krawczyk?
I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
- 509
11
votes
1
answer
676
views
Which MACs can be converted into a secure unkeyed hash function?
It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
- 1,695
11
votes
1
answer
604
views
Which compression functions are PRFs?
In a 2006 paper Bellare showed that HMAC remains secure even if collision resistance for MD5/SHA-1 is broken as long they are still PRFs.
The Wikipedia article on cryptographic hash functions ...
- 4,883
10
votes
1
answer
12k
views
HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication
Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
- 203
10
votes
2
answers
5k
views
Why are HOTP and TOTP implementations all using 6 digits and not more?
I was checking the RFC's after wondering for some time. In RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm, it states on the appendix:
A simple enhancement in terms of security would be to ...
- 333
10
votes
1
answer
2k
views
HMAC for short messages
I am using HMAC (hmac-sha256 to be precise) message authentication without encryption. My question is, is having a short message make it easy to determine what my secret key is?
My C# code is as ...
- 247
10
votes
1
answer
5k
views
Can I use a HMAC for Replay Attack protection?
I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
- 195
10
votes
1
answer
8k
views
Does adding a salt to the message before HMAC processing add any security?
An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function ...
- 203
10
votes
2
answers
12k
views
How does SafeNet MobilePASS generate passwords?
We use MobilePASS at work but the latest version of the android client seems to be buggy so I wanted to have a go at implementing the algorithm myself.
You can download the client to play with here: ...
- 161
10
votes
1
answer
794
views
How does a preimage attack on MD5 break the security of HMAC-MD5?
It was mentioned in an answer to a different question that
it's possible that, any day now, someone might figure out a way to
turn those into a preimage attack, which would compromise the ...
- 4,883
9
votes
3
answers
19k
views
What's the difference between PBKDF2 and HMAC-SHA256 in security?
Being a software developer, I haven't dealt with crypto so far. So I know very little, sorry for that already.
I am aware that you should use bcrypt, scrypt, Argon2 or PBKDF2 for generating a hash ...
- 573