Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
620
questions
1
vote
1
answer
181
views
HMAC of message hash
If I have a message m and want its HMAC, I can simply do HMAC(k, m). But sometimes I am not given ...
- 719
0
votes
1
answer
177
views
An unusual use-case for HMAC as compression function in web browsers
It's an unfortunate fact that, right now (2019), browsers don't expose standardized streaming hashing interfaces in SubtleCrypto. The only way to hash a file, is to ...
- 9,001
0
votes
1
answer
1k
views
Counters in HOTP
In the HOTP (HMAC-based One-time Password) algorithm the client and the server can have different counter values. Es. if an attacker tries to crack the password with no success.
How does HOPT deal ...
- 461
1
vote
1
answer
217
views
Is it OK to just hash a symmetric key to derive an authentication key?
I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
0
votes
1
answer
170
views
Termonology help: What is using AEAD without encrypting data called?
I'm using ChaCha20-Poly1305 in a "full AEAD" mode, where a payload of data is encrypted and a block of unencrypted "additional data" is secured as well.
However, I'd like to also occasionally use the ...
0
votes
2
answers
660
views
Does HMAC provide anything that AEAD does not?
Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available)
Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
0
votes
0
answers
177
views
Some curiosity about HMAC
Is the probability of distinguishing HMAC from a random oracle is the same as the probability of forging HMAC?
Can we say that the following statement is trivial?
$\Pr[\text{Forging $\operatorname{...
- 75
1
vote
1
answer
382
views
are there more efficient methods than HMAC to achieve convergent encryption?
I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...
- 125
1
vote
1
answer
147
views
Is this function a secure MAC?
Consider the following function:
$f_k(mm')=\operatorname{HMAC}_{\operatorname{HMAC}_k(m)}(mm')$
Can I use $f$ as a secure MAC?
- 75
1
vote
1
answer
186
views
What is the best way to forge a tag for a determined message?
Assume a PPT adversary wants to forge a tag for a message. The adversary has oracle access to a verification function. The adversary knows that tags are generated by HMAC-SHA-256 with 128-bit key. I ...
- 75
1
vote
0
answers
61
views
Security of HMAC against an eavesdropper
Assume we are using HMAC-SHA-256 with 128-bit key for authenticating our messages, and an adversary has eavesdropped $n$ (message, tag) pairs.
If the adversary wants to forge a tag for a message $m'$,...
- 75
1
vote
0
answers
49
views
Yubico’s take on U2F wrapping: purpose of MAC?
I've been reading up on Yubico's implementation of U2F.
I am confused on the purpose of the message authentication code (MAC). It prevents an attacker from providing a key handle (particularly a ...
- 11
1
vote
1
answer
103
views
Forging a valid tag for an arbitrary message when you have some knowledge about the key
I am using HMAC-SHA256 with a 128-bit key. Assume my key generator leaks some information to an adversary. Hence, the adversary can predict the key with probability $\alpha$. Can I say that the ...
- 75
0
votes
1
answer
86
views
Is using the same key for different message HMACs insecure?
When using the MAC-then-Encrypt composition, would using the same key for the HMAC in each different message be insecure?
- 474
1
vote
1
answer
85
views
Is it safe to compute HMAC(Base64(IV) || "," || Base64(CipherText)) instead of HMAC(IV || CipherText)?
Let || be the concatenation operator.
Let CipherText = AES(Key1, IV, Message).
Let us assume AES is used in CBC mode.
I want ...
- 234
5
votes
1
answer
397
views
Are there any known problems or attacks for using SHA1(AES_key) as the HMAC key?
See this answer that explains the following sequence of operations:
CipherText = IV|| AES(key1,iv,message)
tag = hmac(key2,ciphertext)
That answer says,
You ...
- 234
1
vote
0
answers
237
views
Secret key suffix vs HMAC [duplicate]
What is the benefit of using HMAC over hash with key suffix? I realize that using key prefix is a bad idea because it allows message extension attacks. When adding key as a suffix such attack ...
- 205
0
votes
1
answer
373
views
HMAC based Key exchange
Alice and Bob need to share public keys to sign/verify ephemeral keys. They have a secret key $K$.
Alice generates a 32 bytes random number $A$, computes $\operatorname{HMAC-SHA256}(K, M||A)$ and ...
- 117
0
votes
2
answers
316
views
HMAC for round-trip validation
I have a need to produce URLs to allow the downloading of a single file, without authentication. These links will be sent through email, and I understand and accept the risk of a given link being ...
- 1
-2
votes
1
answer
210
views
Why do we need HMAC?
AFAIK, HMAC solves the collision problem of hash algorithms by mixing in a pre shared secret.
Can't we just use the pre shared secret to symmetrically encrypt data and leave out the hashing?
user72989
0
votes
0
answers
60
views
Differences between MAC and HMAC [duplicate]
After reading many posts, I am still confused about the differences between these two.
Let me know if my understanding is correct:
MAC is encrypted string that is generated using a secret key and a ...
2
votes
2
answers
347
views
Parallelizing MACs by subdividing the message and then aggregating results
Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC.
Could these be securely parallelized by computing multiple MACs in parallel and then combining the ...
- 896
0
votes
1
answer
184
views
Which HMAC scheme more secure?
Which HMAC scheme is more secure? Or are they of the same level of security?
Scheme One
Compute a HMAC on the data to encrypt (cleartext/plaintext)
Encrypt the data with AES_CTR_256, and append ...
- 474
0
votes
1
answer
274
views
Is using the same MAC twice insecure?
I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key.
Here is the full recipe:
Compute a HMAC on the data to encrypt, and append it to the ...
- 474
2
votes
4
answers
4k
views
How is PBKDF2 so much better than normal Hashing or even using HMAC
I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better ...
- 19
0
votes
0
answers
41
views
What is used as a KEY and MESSAGE when using HMAC within a PBKDF2? [duplicate]
I was studying WPA2 and it's security when I came across this problem. I know that WPA2 uses PBKDF2 to generate a Pairwise Master Key. It does something like this;
...
- 19
0
votes
2
answers
78
views
Determining susceptibility to frequency analysis
I'm looking to create some tokens using a keyed hash mechanism to represent our individual customers. I was planning on using combinations of the customer's personal information (e.g. ...
- 1
2
votes
1
answer
2k
views
How to decide whether to use digital signature (RSA) or HMAC
I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other?
These are some examples:
HMAC SHA256 vs RSA SHA256 - which one to use
What are the ...
- 123
2
votes
1
answer
189
views
Why there isn't a consistent key transform function of HMAC?
I am currently learning, the internal working of HMAC. There exists a key transformation process in the beginning, which works as follows:-
Make the length of $K$ (Key) equal to $B$ (number of bits ...
- 459
2
votes
1
answer
97
views
Can HKDF be instantiated with HMAC-SWIFFT?
While reading through "Cryptographic Extraction and Key Derivation: The HKDF Scheme" by Hugo Krawczyk, I found the following text intriguing:
In some cases, well-defined combinatorial assumptions ...
- 9,001
0
votes
2
answers
95
views
Quick scan which data (hmac/fernet) can be decrypted with a key?
I am designing a secure vault, which stores tens of thousands of encrypted messages and authenticated with Fernet/HMAC, A user query the vault with a key, could I use some kind of index to tell if the ...
- 213
0
votes
1
answer
158
views
Is OpenSSL HMAC vulnerable to length extesion attacks when using MD5 as hash algorithm?
Given that a valid hash for a specific payload is known, would some C code like this be vulnerable to a length extension attack?
...
- 23
0
votes
0
answers
570
views
Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]
I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
3
votes
1
answer
467
views
Is this protocol for masking DB ids sound?
Problem Statement
I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...
- 251
1
vote
1
answer
278
views
Security of 64-bit truncated HMAC of Matrix protocol
I have seen other questions like this one, but I am asking this specifically in the context of Riot messaging and the underlying Matrix protocol.
A basic summary of their message encryption (using ...
- 234
12
votes
3
answers
9k
views
How does AWS Secret key and access key work
Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client?
My guess is:
AWS access key ID is a form of unique user/account identifier
AWS ...
- 351
1
vote
1
answer
816
views
AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them
I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
- 177
9
votes
2
answers
1k
views
Would a HMAC digest make sense in an RSA / ECDSA signature?
When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
- 3,527
2
votes
1
answer
377
views
HMAC computation using AES key
I want to compute an HMAC value of a data set using CKM_SHA256_HMAC mechanism with AES key. I have the error code CKR_KEY_TYPE_INCONSISTENT because it seems that I need to use a key of key_type ...
2
votes
1
answer
302
views
Hash for use in embedded HMAC application
I developed a GNSS logger (http://flysight.ca) which has become popular for scoring skydiving competitions. At the moment, there is little protection against competitors falsifying tracks, but I would ...
- 187
2
votes
1
answer
162
views
Authenticated encryption and file data integrity
I've got a task to provide the integrity and an authenticated encryption for files in our application. I need an assurance if my way of thinking is correct.
I can't use AES GCM, I have to stay with ...
user66005
0
votes
0
answers
743
views
Is reverse engineering SHA256-HMAC function possible? [duplicate]
Assume HMAC function is used to generate a 6-digt integers time-based onetime password. As follows:
$$K_h =\operatorname{HMAC}(k,t) = H((k\oplus\text{opad})\mathbin\| H((k\oplus\text{ipad})\mathbin\|...
- 1
3
votes
0
answers
154
views
Orignal Krawczyk's HKDF vs latest NIST SP800-56C
I've noticed that the original HKDF in rfc5869 defines a feedback loop. So the pseudo-code is something like:
...
- 131
4
votes
1
answer
1k
views
Worth taking performance hit of HMAC to gain additional security?
It seems like SHA-512 truncated to 256 bits is usable as a MAC [1]. The advantage is that it's ~50% faster than HMAC-SHA-256 on 64-bit CPUs and ~50% faster than HMAC-SHA-512 on short inputs. (My use ...
- 331
-3
votes
1
answer
159
views
Which is more secure? $\operatorname{AES-ECB}(key,\operatorname{SHA1}(data+key))$ vs $\operatorname{HMAC-SHA1}(key, data)$ [closed]
$\operatorname{AES-ECB}(key,\operatorname{SHA1}(data+key))$ vs $\operatorname{HMAC-SHA1}(key, data)$
Which is more secure?
Which is faster?
There is a similar comparison here; HMAC-SHA1(key, data) ...
- 27
6
votes
2
answers
3k
views
GMAC vs HMAC in message forgery and bandwidth
Saarinen in his work GCM, GHASH and Weak Keys says that:
The GHASH algorithm belongs to a widely studied class of Wegman-Carter
polynomial universal hashes. The security bounds known (this and ...
- 47.6k
2
votes
0
answers
40
views
Is there an instance where integrity protecting metadata is bad?
In JWEs there's a unprotected data field as well as recipients are not integrity protected. Is there a case where integrity protecting this data would be a problem? If it doesn't make a difference, ...
0
votes
1
answer
731
views
Finding the Input if Hash Value, Hash Function, and Key are known
Let's assume that we have a hash value $h$ is calculated by using HMAC-SHA256.
We have the key $k$. We also know some information about the input:
It contains a pattern like 15 numbers where first ...
- 17
1
vote
1
answer
812
views
How does the user get the private/public key with HMAC based request signing?
I need to implement a HMAC signing of requests and I have read this article which explains the basics of what it is and how to achieve on theory.
https://blog.andrewhoang.me/how-api-request-signing-...
- 113
3
votes
1
answer
3k
views
What are the different use cases between an HMAC and digital signature? [duplicate]
I understand that both an HMAC and digital signature are used to check the integrity and authenticity of a message. Further, I understand that a digital signature is non-repudiatible.
What I do not ...
- 31