Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
620
questions
3
votes
2
answers
360
views
How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?
I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
- 207
2
votes
1
answer
114
views
HMAC256(K,m) vs HMAC256(K,K)
I have a key size of 128 bits. My message size is fairly short (e.g., 32 bits - and widely known). Although I am doing a SHA256, the result of the HMAC will be truncated to 128 bits.
So my question is:...
- 23
3
votes
0
answers
173
views
Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?
HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function.
The hash functions considered in that paper were ones based on the Merkle-...
- 9,001
1
vote
1
answer
313
views
byte significance with hash functions
I am using the python hmac module to generate an authentication code. Given a key, message, and hash function (I am using md5), the library returns an authentication code as a python bytes object. I ...
- 113
3
votes
1
answer
86
views
Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)
Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability?
This is what I mean about doing MtEtM:
...
- 131
2
votes
0
answers
146
views
How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?
I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them.
For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...
- 9,001
2
votes
1
answer
356
views
Encrypting data with HMAC-SHA1 challenge response as the key
I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data.
Generate a non-secret 64 byte random string $M$ (fixed challenge)
Generate ...
- 201
3
votes
1
answer
106
views
Is HKDF one-way, namely given `Ko` it's hard to guess `Ki`?
For background, a HKDF (hmac based key derivation function) takes the form of Ko = KDF(Ki, Label, Context, Len) where Ki is the ...
- 326
2
votes
2
answers
225
views
Prove that you have the data when hash is public
I am designing an online service where users can upload files (3d models) for processing. I want to speed up things when the same file is uploaded by many different users by allowing them to post a ...
- 123
2
votes
1
answer
277
views
PBKDF2-HMAC Collisions
Trying to understand the well known property of these collisions when used with SHA1, SHA256, etc. where a given key is larger than the block size of the digest function. In these cases the smaller of ...
- 21
3
votes
1
answer
365
views
Create a TOTP for machines using HMAC or AES
I'm trying to create a sort of Time-based One Time Password (TOTP) where machines are involved (not humans). In this kind of TOTP the step is 15 minutes between one code to the next one and both ...
- 33
2
votes
1
answer
268
views
Is an HMAC based on a second-preimage resistant hash function always unforgeable?
If hash function is collision-resistant, then its associated HMAC is always unforgeable. But suppose that a hash function is only second-preimage resistant, not necessarily collision-resistant. Then ...
-1
votes
2
answers
885
views
Does HMAC support or guarantee confidentiality? [closed]
I know that HMAC supports or guarantees both authentication and integrity, but does it also provide confidentiality?
1
vote
2
answers
490
views
Break HMAC-SHA256 of PAN with known hash?
Imagine a database containing hashed (HMAC) Primary Account Numbers (PANs ) and associated identifiable information (e.g. transactions).
Consider a data breach. Prior to the breach, an attacker made ...
- 13
1
vote
1
answer
317
views
Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?
Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is:
take a secret material which will work as "generator&...
1
vote
1
answer
305
views
Authenticated, Quantum-resistant GPG2?
GPG2 does not provide authentication. It still uses SHA-1 by default. It does not seem to get any stronger as time goes by.
If one were to pass a randomly-generated symmetric key (from a TRNG) over ...
- 11
0
votes
1
answer
201
views
Is it safe to use the same password/secret for both VeraCrypt volume and its HMAC?
I am trying to script the integrity check of a VeraCrypt volume.
...
- 189
3
votes
2
answers
355
views
Extending AES-GCM initialization vector
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
- 1,175
5
votes
1
answer
957
views
How is it possible that these two encryption functions yield the same result?
I opened this post in stackoverflow some time ago where I explained a problem I had about not finding a way that would allow to successfully get the result of a string encrypted with a "aes-256-...
- 153
1
vote
1
answer
273
views
HMAC SHA256 - fixed vs dynamic key - security and collision impacts
Assume we should apply an hmac sha256 on different messages made of incremental numbers (Ex. 1 to 1 billion).
Does it make sense in terms of security to apply a different fixed key for each message?
...
- 13
3
votes
1
answer
189
views
With AES encryption and a known key and plaintext, can an attacker create a different key and plaintext resulting in the same ciphertext?
In short: with AES encryption can an attacker create a new key2 and plaintext2 so that AESkey1(plaintext1) = AESkey2(plaintext2)
If so, can it be solved by just applying for instance a MAC like AES-...
- 55
2
votes
1
answer
71
views
HMAC for hash list
If I have a very large input to hash with a hash function vulnerable to length extention and I am using a hash list, should I HMAC each part of the input or just HMAC the final hash of all the hashes ?...
- 373
0
votes
1
answer
155
views
Using HMAC with AES modes that do NOT require padding [closed]
I'm trying to use HMAC with AES modes that do not require any sort of padding.
Although I am aware that modes like AES-GCM and ...
- 105
6
votes
1
answer
745
views
OpenSSL FIPS integrity check
As far as I know, FIPS requires a set of self tests (POST) to verify the cryptographic algorithms permitted and the integrity of the module.
These tests are performed at run-time, so OpenSSL does a ...
- 63
2
votes
1
answer
85
views
What is the best way of deterministically choosing N of M, given 32 bytes of sha256?
I have a list of M=10,000..100,000 items and 32 bytes of sha256 H.
I want to choose N=10..100 items (without order).
Is there an efficient way to do this?
Or should I use something like ...
- 897
2
votes
0
answers
76
views
Why the salt is used as a key in the extract phase of HKDF?
What is the reason that in the HKDF standard (RFC5869), in the "extract" phase, the 'salt" parameter is instantiated as HMAC key, and the secret keying material 'IKM' is instantiated as HMAC input ...
- 1,066
1
vote
1
answer
406
views
Is it okay to reuse a single symmetric key for a large volume of messages and HMACs, so long as "nonces" are randomly generated for both of them?
https://www.reddit.com/r/crypto/comments/fnku50/nonce_reuse_vs_iv_reuse/
Nonce reuse with the same key is catastrophic to security. The same premise holds for
initialization vectors. If the key ...
- 59
1
vote
0
answers
35
views
Integrity for mixture of encrypted/unencrypted database fields
I have multiple blobs each (symmetrically) encrypted with its own randomly generated key.
Now I want to encrypt these blob keys with user keys and store them in a database.
A table could have the ...
- 157
2
votes
1
answer
257
views
Why Authenticated Encryption the same message again is not secure?
It is the Exercise 9.14 (9.1) from the book A graduate course in applied cryptography by Boneh and Shoup.
Let $(E, D)$ be an AE-secure cipher.
a. $E_1(k,m):=(E(k,m), E(k,m));$
$$D_1(k,(c_1,c_2)):= ...
- 23
1
vote
1
answer
390
views
does using an HMAC protect against hash table DoS attacks?
For a hash set where the values are supplied by a third party, one concern is that an attacker can run a denial of service attack by creating many values that all fall into one bucket of the hash ...
- 125
2
votes
2
answers
583
views
What is the difference between a PRF and a PRP, and are cryptographic hash functions the same as HMAC (PRFs or PRPS)?
I read one answer to a similar question that put forth that a hash function is distinct from a PRF, however I've also found materials purporting that cryptographic hash functions are PRFs, and I'm not ...
- 59
1
vote
1
answer
98
views
Is it possible to affect the output of HMAC w/ SHA-512 by providing it with a custom message?
Consider an HMAC algorithm that uses SHA-512 with an unknown private key. Is it possible to affect its output, either partially or totally, by providing it with carefully crafted messages?
For the ...
2
votes
0
answers
91
views
Why is double encryption used to generate EphIDs in DP3T?
The most famous proposed COVID-19 application is DP3T. In this app a user constantly broadcasts EphIDs generated from a secret key as follows:
$$EphID 1 || ... || EphID n = PRG( PRF(SK_t , “broadcast ...
- 21
2
votes
1
answer
428
views
Does pepper *require* an HMAC?
Assume you are already given a properly-salted, password hash $X$ from some slow PBKDF (e.g., like Argon2id).
Now, you want to apply some large (~256-bit) secret "pepper" $S$ to it before storing it ...
- 323
-1
votes
1
answer
54
views
how to predict a sequence for reverse engineering of a ticketing system [closed]
i am student in the fith year of college IT-science and a crypto noob.
i have been wondering how the folwing sequence of ticket i bougth in all at once were built for :
how they work or how they are ...
- 1
0
votes
0
answers
985
views
How to bruteforce password from HMAC-SHA256 hash (if you have the key)?
Short of creating one's own script / program, is there an existing, readily available way of iterating through a list of potential passwords to find which one corresponds to a hash (HMAC-SHA256), ...
- 1
1
vote
1
answer
240
views
Key at start or end of HMAC
In the book Information Security Principles and Practice, the author explains why HMAC should be used for integrity with a symmetric key with the message, to prevent a MiTM to replace both the message ...
- 11
1
vote
1
answer
400
views
SHA1 standard steps
I'm a computer engineering student and I want to implement a cryptographic function for a college project. I want to realize my personal implementation of a WPA2 hash producer in C (and upload it to ...
- 13
1
vote
2
answers
473
views
Can a MAC be used as a HMAC?
I am reading through an information security book right now, and a confusing question poses itself to me:
"Could you use a MAC as a HMAC? That is, does a MAC satisfy the same properties that a ...
8
votes
1
answer
1k
views
How many codes can I safely generate using the same HMAC key?
Can an attacker guess the key given enough codes for the same key? And if so, how many times is it safe to use the same key?
- 183
2
votes
2
answers
800
views
How to design a secure challange-response authentication protocol?
I am implementing a custom challenge-response protocol to authenticate a client to a server. Mutual authentication is not required, i.e. the server doesn't need to be authenticated to the client.
The ...
0
votes
1
answer
178
views
Using the output of HKDF directly
I am using HKDF with an IKM and salt, the OKM is used as the key for an HMAC operation. The HMAC algorithm is authenticating messages in a communications system
The salt is the concatenation of 2 ...
- 3
0
votes
1
answer
858
views
Length extension attacks, Merkle–Damgård constructions, and HMACs
The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks."
However, HMACs can be ...
- 117
-1
votes
1
answer
289
views
How to implement nonce for hashing a 6 digit sensitive number with hmac with its secret key
I have to pass a 6 digit number which has to be kept very secret through a unsecured netwok.
I am thinking to hash it using hmac and a secret key which only me and the reciever knows
So the code ...
- 113
1
vote
1
answer
137
views
can I use PBKDF2 instead of hmac as a hashing tool for sensitive data
I have read about hmac and PBKDF2.
PBKDF2 - is mainly used for password hashing. It uses ...
- 113
2
votes
1
answer
489
views
Security Considerations in using SHA-1 for One Time Passwords
SHA-1 is considered broken. That's why I'm assuming that using SHA-1 for RFC2289 OTPs is broken as well. Is this assumption correct?
Going further with this assumption using SHA-1 for RFC4226 HOTPs ...
- 23
2
votes
2
answers
261
views
Can the HMAC of a pre-hash be considered equivalent to an HMAC of the message?
Assume:
size of m = 1kB
HMAC hashing function = SHA256
H hashing function = SHA256
It seems reasonable to think that there would be no difference in authenticating a message if either HMAC(k, m) or ...
- 31
-4
votes
1
answer
353
views
The output size is smaller than input size is a insecure to hash function [closed]
Why it will be unsafe, and can be break?
- 45
0
votes
0
answers
52
views
What's the use of HMAC in PBKDF2? [duplicate]
As far as I know, PBKDF2 uses an underlying pseudorandom function in order to generate a hash (like SHA256) so as far I understood PBKDF2 is basically a hash function that uses an underlying function ...
- 1
1
vote
1
answer
314
views
Protect the original message of a hash from brute force
My apologies for the somewhat inaccurate terminology.
Basically I have some simple messages (entropy ~50 bits) the user will use for registration. The messages should remain private, and I don't ...
- 165