Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
5 votes
1 answer
590 views

Do I understand HMAC-SHA-xxx and HMAC-SHA-xxx-yyy correctly?

I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly. Am I right about these three things? HMAC-SHA-xxx has an output length of xxx ...
Jan's user avatar
  • 53
1 vote
0 answers
248 views

What lightweight cryptographic hash function for short input could I use for HMAC? [closed]

I am looking for a cryptographic hash function that I can configure for HMAC. The input that I will hash is around 50 bytes. The function must be fast, and computationally lightweight.
Ninja Bug's user avatar
  • 319
0 votes
1 answer
94 views

Correlate HMAC key and MAC without message

If I have a HMAC_SHA1 MAC and a potential key, can I check whether this key could have produced this signature without knowing any of the message body plaintext?
Mihail Malostanidis's user avatar
2 votes
3 answers
2k views

AES-GCM not using two keys

It is recommended to use different keys for different purposes, such as encryption and integrity protection. As I see it, AES-GCM only requires one key as input. Two different keys are then generated ...
user avatar
9 votes
1 answer
2k views

HMAC-SHA-512 with a 256-bit key

I am implementing hmac-sha-512 in an integrated system. However, one subsystem is only supports the use of 256-bit keys. I read in https://www.rfc-editor.org/rfc/rfc4868 that: However, note that [...
user avatar
4 votes
3 answers
775 views

Encrypt-then-MAC with base 64

I've a doubt about the Encrypt-then-MAC approach when using HMAC-SHA-256 with AES-128 in CBC mode, as seen in https://en.wikipedia.org/wiki/Authenticated_encryption. I need to encode the resulting ...
GianZanuz's user avatar
2 votes
2 answers
3k views

HMAC-SHA-512 output randomness?

This is regarding an online roulette game that claims to be fair. Here is the explanation: Two strings are created: STRING1 = "[NONCE]:[SERVER SEED]:[NONCE]" STRING2 = "[NONCE]:[CLIENT ...
user61363's user avatar
1 vote
1 answer
73 views

Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?

Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?
thecat's user avatar
  • 121
8 votes
4 answers
1k views

Could a 6502 CPU safely compute a SHA-1 hash in a reasonable length of time?

The 6502 is the CPU in a Tamagotchi (which can be hacked to run custom code). SHA-1 is the default hash used for TOTP (the algorithm used by two-factor authentication tokens and apps). Hopefully you ...
user371366's user avatar
1 vote
2 answers
119 views

How to provide partial confidentiality and full integrity for a protocol message?

I want to provide confidentiality and integrity for a protocol. I don't want to encrypt the entire protocol message. I do not want to encrypt the header and timestamp of the protocol message, but I ...
Aymn Alaney's user avatar
5 votes
3 answers
6k views

When do I need to use CBC and HMAC?

As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
Aymn Alaney's user avatar
7 votes
2 answers
366 views

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

$\require{begingroup}\begingroup \DeclareMathOperator{\keccak}{\mathrm{Keccak}} \DeclareMathOperator{\concat}{\|} $According to Keccak's website, $\keccak(k \concat x)$ is safe: Unlike SHA-1 and ...
MCCCS's user avatar
  • 731
1 vote
0 answers
668 views

Is it still safe to use sha1 as an hmac hash function in 2018 [duplicate]

I'm curious if it's safe to use sha1 for an HMAC in 2018 in a platform product. A popular vendor (Twilio) uses an HMAC with sha1 with a shared secret to validate that messages they send are indeed ...
greggles's user avatar
  • 111
1 vote
2 answers
826 views

Is an AEAD the recommended method to add encryption + HMAC to a protocol?

Assuming you are dealing with a competent developer/team, and you are advising on adding security to their protocol. Also for the time being lets not worry about the key establishment and validating ...
SFlow's user avatar
  • 465
1 vote
1 answer
440 views

Authentication scheme using HMAC

I have an authentication service, a client and an application service. The client needs to use the application, but they have to be authenticated first. I'm trying to create a simple scheme to do ...
Unknown's user avatar
  • 113
0 votes
1 answer
123 views

Challenging Question for the Build a Secure MAC with Special Properties

We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable. [Note that unsuccessful attempts to build such a scheme ...
Robert's user avatar
  • 51
3 votes
3 answers
280 views

Two salts, One password

If I have two different MD5 password hashes with two different salts (the salts are known), is there any way to cryptographically deduce if the two passwords match? Other than brute force password ...
Jonas Bjork's user avatar
5 votes
2 answers
2k views

What is the reason of using Pedersen Commitment scheme over HMAC?

I want to implement non-interactive Bit Commitment scheme for messages of arbitrary length. And I am curious, what is the reason of using Pedersen Commitment scheme over Salted Hash (in other words ...
warchantua's user avatar
7 votes
1 answer
11k views

HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC. I found this table in RFC5246: ...
Eddie's user avatar
  • 983
4 votes
2 answers
2k views

HMAC does it matter if I chose the cipher text or the plain text as the message? [duplicate]

I am using HMAC to create a message authentication code. My question is, does it matter if I use cipher text + encryption key or ...
pesdfa's user avatar
  • 43
3 votes
0 answers
53 views

Is this a more effective HMAC? [duplicate]

I was given an argument in a conversation today and I don't know how to respond to it: H( k || m || k ) should be a better choice of MAC than the traditional HMAC. The person's rationale was that: "...
ItBothersMe's user avatar
2 votes
1 answer
65 views

Signing different types of messages with the same asymmetric key

I want to be able to sign different types of messages with the same asymmetric key. (For completeness, I am using Ed25519 for my signatures). Why do I want to do this? The same key is used to sign ...
real's user avatar
  • 153
2 votes
1 answer
1k views

HMAC SHA256 for deriving session keys using random nonce

I need to derive session key in order to create an application layer secure channel between mobile app and a bluetooth device. My scheme is similar to this scheme that uses a HMAC and counter. ...
arahaeldor's user avatar
2 votes
1 answer
1k views

Is transporting a salt, IV, ciphertext and HMAC in an encrypted token an acceptable practice?

I’m porting over some crypto code from Mcrypt (deprecated) to OpenSSL. I’m following a process that a former employee implemented, which is as follows: Create a random salt for use in a PBKDF2 key ...
Robert's user avatar
  • 121
11 votes
2 answers
3k views

How many trials does it take to break HMAC-MD5?

I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
ladybug's user avatar
  • 213
2 votes
2 answers
1k views

What is a size of mac_length and mac_key_length for TLS cipher suites HMAC using SHA384 and SHA512?

i failed to find explicit definition of hash output size and mac_key_size for hmac based on SHA384 and SHA512. RFC5246 specifies: but defines only
Elena Gurevich's user avatar
3 votes
0 answers
205 views

How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?

I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes). For ...
Victor Iorinescu's user avatar
-1 votes
2 answers
498 views

Is HMAC a suitable substitute for HKDF?

My PHP version does not include the hash_hkdf() function, and upgrading versions is not worth the trouble for my project (which is for personal pleasure, not for ...
someguy11's user avatar
0 votes
1 answer
516 views

6 Byte for HMAC in wireless system secure?

A wireless system has 8 byte payload and 6 byte for message authentication. Scheme: ...
Werner W's user avatar
3 votes
1 answer
513 views

Which one is better using DSA, or MAC and encryption?

I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA. by using MAC, I required a shared key between ...
Aymn Alaney's user avatar
1 vote
0 answers
124 views

Tree structure with XTS and HMAC: MAC in parent

Situation: A file format contains a tree-like data structure; parent nodes can find children and child nodes can also find their (single) parent. To protect confidentiality, the nodes in the file are ...
aaa's user avatar
  • 11
0 votes
1 answer
2k views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
daralim's user avatar
  • 37
2 votes
1 answer
53 views

Expanding truly random key into printable password for successive hashing

The STUN network protocol defines its client authorization in the terms of message-integrity check employing the following scheme [RFC5389, section 10.2]: $$ \DeclareMathOperator{\HMAC}{HMAC} \...
firegurafiku's user avatar
6 votes
1 answer
2k views

Recommended key lengths for BLAKE2b

RFC 7693 provides the following table of standard parameter sets for BLAKE2b without a key (where nn is the hash size in bytes): ...
user42529's user avatar
  • 103
1 vote
1 answer
5k views

Which algorithm has better performance (HMAC, UMAC, and Poly1305)?

I want to implement a protocol which requires Integrity and Authentication for its messages. I found a lot of algorithms such as HMAC, UMAC, and Poly1305 which provide Integrity and Authentication. So ...
Aymn Alaney's user avatar
1 vote
0 answers
53 views

MAC with key supplied afterwards

Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
Maarten Bodewes's user avatar
  • 91.7k
0 votes
1 answer
76 views

Multikeyed Hash: known algorithms?

A MAC (or HMAC) can be represented by the general formula: MAC = H(key, message) I am calling "Multikeyed Hash" the operation (probably there exists already a ...
ribamar's user avatar
  • 145
1 vote
0 answers
408 views

How many bits should I use for bearer tokens?

I'm in the process of developing a service that can be accessed with bearer tokens. Currently I'm using a random UUID converted into a URL safe format. That is 128 bits. Users will be authenticated ...
nagylzs's user avatar
  • 113
0 votes
1 answer
140 views

Security of using sha(secret + rand)

I have come across some security implementations in which party A will compute MD = sha256(secret + rand) and transmit MD and rand to a counterpart B. If the second party knows the secret, then when ...
Code Wiget's user avatar
0 votes
1 answer
2k views

Doubt about the possible attacks on HMAC

I have a question about the security of HMAC: If I know the value of the seed and the value of the HMAC but I don't know the key then I can't do the birthday attack because I can't generate an ...
Serena89's user avatar
1 vote
1 answer
1k views

HMACSHA256 2.5 times faster than HMACSHA512

According to the answers to a previous question, the 512 version should be faster on x64 devices. And even if it were executed on an x86 (32 bit) device - there shouldn't be such a big difference. ...
ispiro's user avatar
  • 1,985
0 votes
1 answer
137 views

Do I need to use HMAC in this crypto wallet backup application?

I'm building an application for securely backing up cryptocurrency private keys or 12-word backup phrases that crypto wallets use as a seed to generate private keys. For the purpose of this question, ...
Ransauce's user avatar
  • 103
4 votes
1 answer
139 views

Why would we want parallelizable authentication?

I believe that parallelizable authentication schemes are superior from an aesthetic perspective and because most non-recursive calculations (e.g., CTR, ECB, PMAC, etc.) are better than recursive ones (...
Melab's user avatar
  • 3,635
3 votes
2 answers
548 views

PBKDF2 with longer than native output length - Will hashing the result help?

I've seen it mentioned more than once that PBKDF2 should not be used to create a longer key than the native output (such as 160 bits when used with HMACSHA1). Since an attacker could test only the ...
ispiro's user avatar
  • 1,985
2 votes
2 answers
1k views

HMACSHA1 vs HMACSHA2 (for PBKDF2)

I need to choose an HMAC function for PBKDF2. I'm using .net so I don't have the option to use SHA3. At first glance, and according to this answer by Thomas Pornin it seems like SHA512 would be best....
ispiro's user avatar
  • 1,985
2 votes
1 answer
497 views

Do Message Digests protect public cryptography from replay attacks? [duplicate]

I read about HMAC and want to be sure if it protects against replay attacks as well.
bruno fagioli's user avatar
9 votes
3 answers
19k views

What's the difference between PBKDF2 and HMAC-SHA256 in security?

Being a software developer, I haven't dealt with crypto so far. So I know very little, sorry for that already. I am aware that you should use bcrypt, scrypt, Argon2 or PBKDF2 for generating a hash ...
Aliquis's user avatar
  • 573
10 votes
1 answer
12k views

HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
W.M.'s user avatar
  • 203
1 vote
1 answer
2k views

Padding Oracle Attack with AES-128-CTR and MAC

Assume Alice and Bob are communicating using 'MAC then Encrypt' paradigm. Specifically, they are using HMAC with SHA256 as the hash function and the output is truncated to 40 bits. They are using AES-...
AnswerFinder95's user avatar
0 votes
1 answer
147 views

What are the different uses of MAC and Digital Signature?

I know both of them can be used for Integrity and Authentication. In which practical cases is preferred a MAC? and a Digital Signature? Thank you in advance
Darumaseye's user avatar

1
3 4
5
6 7
13