Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
3
votes
1answer
423 views

Is it a vulnerability (for message authentication) to have a variable iteration-count for PBKDF2?

The scenario: A user clicks on an encrypted file, and enters his password, in order to decrypt and authenticate it using HMAC (when its key is derived using PBKDF2). If the iteration-count is fixed, ...
1
vote
0answers
159 views

Can we use different mode for decryption instead of using mode which is used in encryption? [closed]

I am decrypting the Apple Payment Token in Demandware, the apple pay token is encrypted in GCM mode, but in Demandware, we don't have GCM mode in Cipher class, so can I use other modes for decryption? ...
0
votes
2answers
259 views

Securing an end-to-end encrypted cloud based address book

I am analyzing an existing end-to-end encrypted, cloud based service (e.g. email, file storage or chat) which also has a public cloud based address book (for managing contacts) so that users of the ...
0
votes
1answer
75 views

Restricting symmetric key usage

I have a system where some clients communicate with a server. every client has its own name and role and some other parameters that sends these info to the server in every message and the server uses ...
0
votes
1answer
1k views

Securing http session id's by appending HMAC hash?

First, I apologize if this question is off topic as defined here. If so, please let me know and I'll close it. I'm building a sessions middleware for an http service and thought it might be a good ...
4
votes
1answer
907 views

How Pairwise Transient Key is derived or generated?

I recently study WPA/WPA2 security and I want to know how PTK is derived. I found these parameters in the IEEE 802.11 standard (2012): ...
3
votes
1answer
127 views

Can HMAC confirm data existence?

I have two hosts, A and B. Host A gives host B a large piece of data and deletes it. Host A then needs to periodically confirm host B is holding the piece of data. Before deleting the data Host A ...
2
votes
1answer
654 views

SHA3 HMAC key padding

According to the pseudocode, keys longer than the block-size of the underlying hash function are shortened by hashing the key. Furthermore, keys shorter than the blocksize are zero-padded up the ...
1
vote
1answer
50 views

What is mac-and-continue?

I've seen the term mentioned in a paper by the Keccak team here, and by Adam Langley here when talking about properly authenticating stream ciphers. What does it actually mean, and how does it work? ...
3
votes
2answers
185 views

Why isn't this HMAC construction/check secure?

A MAC is calculated the following way: mac = sha1(secret || m)[0:8] [0:8] denotes taking the first 8 characters from the resulting hash. The length of the ...
1
vote
1answer
103 views

What is the value of the fpad used in the NMAC?

NMAC uses an fpad value that is appended to the output of the Cascade function in the penultimate step of the algorithm (as depicted here, p.63) before it is sent to the last step of the NMAC ...
1
vote
0answers
170 views

HMAC usage in hybrid encryption scheme [duplicate]

Consider the following hybrid encryption scheme (B3||4 is for concatenated IV and AES-CBC encrypted message): ------------------------------------------------------...
1
vote
1answer
787 views

Is key derivation of a token shared secret necessary for usage of token in TOTP as specified by RF6238?

TL;DR: Is it necessary to generate a 'random' key from a shared token secret string before putting it into a TOTP algorithm that follows the RFC 6238 specification? Or is it okay for me to put the ...
3
votes
1answer
318 views

Is HMAC-MD5 collision-resistant if the key is unknown?

I'm in a situation where I need to use HMAC-MD5 (for a learning, non-production application) and it needs to be collision-resistant. So my question: Is HMAC-MD5 collision-resistant if the key is ...
10
votes
1answer
654 views

How does a preimage attack on MD5 break the security of HMAC-MD5?

It was mentioned in an answer to a different question that it's possible that, any day now, someone might figure out a way to turn those into a preimage attack, which would compromise the ...
4
votes
0answers
97 views

Which compression functions are MACs?

The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed). How does this relate to common assumptions for ...
11
votes
1answer
453 views

Which compression functions are PRFs?

In a 2006 paper Bellare showed that HMAC remains secure even if collision resistance for MD5/SHA-1 is broken as long they are still PRFs. The Wikipedia article on cryptographic hash functions ...
3
votes
1answer
403 views

HMAC and hashed

If I understand correctly, a HMAC is basically a keyed hash. Just a general yes or no question but is a keyed hash (HMAC) basically a rainbow table resistant hash? This is because you can't decrypt ...
1
vote
1answer
339 views

Is there any vulnerability if I hmac(key,key)?

It is a general question, but I'm using SHA-2. My reason is to take a short pin or string and to generate a longer hash of that pin to locally generate a local key for personal use to be used to ...
1
vote
1answer
114 views

Why avoid custom HMAC implementations like the following?

H (o_pad || H (i_pad || m, static_salt), static_salt) Where the Hash algorithm used is SHA512-crypt: https://www.akkadia.org/drepper/SHA-crypt.txt What if an attacker knows the o_pad, i_pad, the ...
5
votes
1answer
269 views

Suggestions for improving encrypt-then-mac flow

I have a large piece of data I want to encrypt, and I have a key master_key. Rather than encrypt the data directly with ...
0
votes
2answers
449 views

Difference b/w Hash function & Keyed Hash function? And HMAC with Matyas-Meyer-Oseas hash function

I am looking for hash functions. In this process i came across hash & keyed hash functions(HAMC). In which it uses some has function to generate MAC. And also Matyas-Meyer-Oseas hash function, ...
8
votes
1answer
703 views

An example of an appropriate use case for AES-CBC encryption without authentication?

I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community. Recently in this question AES in CBC Mode Is totally unsecure if ...
3
votes
1answer
64 views

Is it feasible to design a crypto scheme for centralised reporting of anonymized data?

I would like to find out if it is feasible to design a cryptographic scheme that would allow several "reporting parties" to independently transfer information to the same centralised "authority", ...
3
votes
1answer
614 views

Information theoretic message authentication code (MAC)

Let's $\ a,b\ $ be two (pseudo)random independent values, and $m$ be a message, where $a,b,m \in \mathtt{F}_p$, where $p$ is a large prime number. Question 1: Is $\ am+b\ $ an information theoretic ...
2
votes
2answers
224 views

HMAC with secret hash constants

An HMAC depends on the Message, Key and the Hash function used such as SHA-256, SHA-512, etc. Consider if the computation of the MAC used a different set of Initial hash values or initial array of ...
2
votes
1answer
311 views

How much entropy is lost if 1 character is fixed in HMAC SHA-512?

We have an entropy source called “Entropy”. We encode this entropy with HMAC-SHA512 using a “Key”. The Key is public, but the Entropy is secret. We are then testing for the HMAC-SHA512 output in order ...
5
votes
1answer
354 views

Signing dynamic data on an embedded system

I have built a GPS based on the AVR microcontroller. The GPS is used to log flight data for competitions. The log file is updated 10 times per second. What I'd like to do is to associate a signature ...
5
votes
1answer
6k views

Why is Fernet only AES-128-CBC?

I have a communication system that's currently encrypted using AES-256-CBC. Someone on Information Security StackExchange asked whether I'm using HMAC, so I'm looking into Fernet. Fernet seems to use ...
1
vote
2answers
246 views

Key used by HMAC-SHAx in PBKDF2 [duplicate]

PBKDF2 can be used to derive a key from a passphrase, having in input the passphrase, the chosen number of iterations to slow down a brute force attack, a random salt and the chosen keylength. In its ...
0
votes
0answers
474 views

How to use private key with Hash algorithims for storing passwords [duplicate]

UPDATE Found an answer here: Recommended way of adding a pepper/secret key to password before hashing? After reading https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords ...
3
votes
1answer
2k views

Length of truncated HMAC output

RFC 2104 says: Applications of HMAC can choose to truncate the output of HMAC by outputting the t leftmost bits of the HMAC computation for some parameter <...
1
vote
1answer
63 views

Can we associate HMAC signed messages with each other?

Assume: $hmac(K, m) = M$ $hmac(K, m') = M'$ Can we associate that $M$ and $M'$ were signed by the same $K$? Given $M$ and $M'$ and that we know they were signed with the same $K$, can we calculate ...
1
vote
1answer
538 views

Is this symmetric key MAC-then-encrypt auth token methodology secure?

NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be ...
1
vote
1answer
293 views

I want to know difference of calculation cost between SHA(hash) and AES(reversible encryption)

I want do detect illegal modification of a string by using HMAC-SHA256 or AES/CBC/PKCS5Padding, with low calculation cost. Which is the best answer? I plan to save data in a DB with one of the ...
10
votes
1answer
599 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
6
votes
2answers
468 views

HMAC - What does “in transit” mean

I often read that MAC's provide a proof of authenticity of a payload 'in transit'. I'm wondering though is there any special definition of "in transit" that would prevent it from being reliable over ...
1
vote
1answer
699 views

Key shortening for hmac sha256

For learning purpose, I'm trying to implement HMAC using SHA256. In the pseudo code proposed in Wikipedia, the algorithm first focus on how to shorten or expand the key : ...
4
votes
2answers
354 views

Use HMAC or encryption for deep links?

On a few occasions I've converted URLs with authentication via a session cookie to deep link URL's with no cookie authentication. These are URL's with simple id's like ...
2
votes
0answers
87 views

Is $H(k \operatorname\| H(k \operatorname\| m))$​ with double length $k$ like NMAC? [duplicate]

I know that NMAC is mathematically proved with two different keys with length $L$. But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of ...
1
vote
1answer
119 views

Help understanding NIST HMAC

The NIST (National institute of standards and technology) defines the HMAC standard as the following: $$\operatorname{MAC}(\text{text}) = \operatorname{HMAC}(K, \text{text}) = H((K_0 \oplus \text{opad}...
7
votes
2answers
457 views

MAC where key is provided afterwards

I was just wondering if there is a MAC scheme where the key provided after part of the message has been hashed. I was just looking at TLS 1.3 and a comment of Thomas Pornin where the messages needed ...
0
votes
1answer
379 views

Number of words to be outputted from PBKDF2 based on HMAC-SHA512?

I'm using PBKDF2 to generate a 512 bit key. My question is language agnostic, but for the sake of demonstration, I'm using CryptoJS, which defaults to using SHA1, but can be overridden like so: ...
0
votes
1answer
276 views

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good? For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...
4
votes
1answer
592 views

Why is a HMAC using a 32bit tag not prone to birthday attacks?

Why is a HMAC using a 32bit tag not prone to birthday attacks? I have read that it has something to do with the fact a birthday attack isn't really possible if the output size is not large enough. ...
1
vote
1answer
2k views

Why does appending a message to a key before hashing not guarantee integrity? [duplicate]

I want to guarantee the integrity of a message $m$. My first thought is to append the message to an integrity key $k$ and hash it as $H(k\,||\,m)$. However, I have been told that this is not totally ...
1
vote
2answers
94 views

security of design for sending files

let's say I have a protocol to send a fi le $F$. I am intending to employ AES in CBC mode for encrypting $F$ where the $IV$ is randomly chosen. For authenticity, I am employing $HMAC$ to compute a ...
0
votes
1answer
103 views

Improving the security of this tag

So we have the protocol: $Bob \to Alice \Rightarrow m\ ||\ h(m, ``secretTag")$ With above scenario, a message is passed to Alice with an authentication tag to prove that the message was sent by Bob. ...
3
votes
1answer
141 views

Is This method of generating Initialisation Vector for Cipher Block Chaining secure?

I have worries about security defined in BACnet protocol (ASHRAE/ANSI Standard 135, ISO 16484-5). Full text of security is here: http://bacnet.org/Addenda/Add-135-2008g.pdf and here is my summary: In ...
23
votes
6answers
4k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...

1
3 4
5
6 7
11