Questions tagged [hmac]
HMAC is a method for constructing a message authentication code based on a cryptographic hash function.
620
questions
5
votes
1
answer
590
views
Do I understand HMAC-SHA-xxx and HMAC-SHA-xxx-yyy correctly?
I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly. Am I right about these three things?
HMAC-SHA-xxx has an output length of xxx ...
1
vote
0
answers
248
views
What lightweight cryptographic hash function for short input could I use for HMAC? [closed]
I am looking for a cryptographic hash function that I can configure for HMAC. The input that I will hash is around 50 bytes. The function must be fast, and computationally lightweight.
0
votes
1
answer
94
views
Correlate HMAC key and MAC without message
If I have a HMAC_SHA1 MAC and a potential key, can I check whether this key could have produced this signature without knowing any of the message body plaintext?
2
votes
3
answers
2k
views
AES-GCM not using two keys
It is recommended to use different keys for different purposes, such as encryption and integrity protection. As I see it, AES-GCM only requires one key as input. Two different keys are then generated ...
9
votes
1
answer
2k
views
HMAC-SHA-512 with a 256-bit key
I am implementing hmac-sha-512 in an integrated system. However, one subsystem is only supports the use of 256-bit keys.
I read in https://www.rfc-editor.org/rfc/rfc4868 that:
However, note that [...
4
votes
3
answers
775
views
Encrypt-then-MAC with base 64
I've a doubt about the Encrypt-then-MAC approach when using HMAC-SHA-256 with AES-128 in CBC mode, as seen in https://en.wikipedia.org/wiki/Authenticated_encryption.
I need to encode the resulting ...
2
votes
2
answers
3k
views
HMAC-SHA-512 output randomness?
This is regarding an online roulette game that claims to be fair. Here is the explanation:
Two strings are created:
STRING1 = "[NONCE]:[SERVER SEED]:[NONCE]"
STRING2 = "[NONCE]:[CLIENT ...
1
vote
1
answer
73
views
Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?
Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?
8
votes
4
answers
1k
views
Could a 6502 CPU safely compute a SHA-1 hash in a reasonable length of time?
The 6502 is the CPU in a Tamagotchi (which can be hacked to run custom code). SHA-1 is the default hash used for TOTP (the algorithm used by two-factor authentication tokens and apps). Hopefully you ...
1
vote
2
answers
119
views
How to provide partial confidentiality and full integrity for a protocol message?
I want to provide confidentiality and integrity for a protocol. I don't want to encrypt the entire protocol message. I do not want to encrypt the header and timestamp of the protocol message, but I ...
5
votes
3
answers
6k
views
When do I need to use CBC and HMAC?
As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
7
votes
2
answers
366
views
Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$
$\require{begingroup}\begingroup
\DeclareMathOperator{\keccak}{\mathrm{Keccak}}
\DeclareMathOperator{\concat}{\|}
$According to Keccak's website, $\keccak(k \concat x)$ is safe:
Unlike SHA-1 and ...
1
vote
0
answers
668
views
Is it still safe to use sha1 as an hmac hash function in 2018 [duplicate]
I'm curious if it's safe to use sha1 for an HMAC in 2018 in a platform product.
A popular vendor (Twilio) uses an HMAC with sha1 with a shared secret to validate that messages they send are indeed ...
1
vote
2
answers
826
views
Is an AEAD the recommended method to add encryption + HMAC to a protocol?
Assuming you are dealing with a competent developer/team, and you are advising on adding security to their protocol. Also for the time being lets not worry about the key establishment and validating ...
1
vote
1
answer
440
views
Authentication scheme using HMAC
I have an authentication service, a client and an application service.
The client needs to use the application, but they have to be authenticated first. I'm trying to create a simple scheme to do ...
0
votes
1
answer
123
views
Challenging Question for the Build a Secure MAC with Special Properties
We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable.
[Note that unsuccessful attempts to build such a scheme ...
3
votes
3
answers
280
views
Two salts, One password
If I have two different MD5 password hashes with two different salts (the salts are known), is there any way to cryptographically deduce if the two passwords match? Other than brute force password ...
5
votes
2
answers
2k
views
What is the reason of using Pedersen Commitment scheme over HMAC?
I want to implement non-interactive Bit Commitment scheme for messages of arbitrary length.
And I am curious, what is the reason of using Pedersen Commitment scheme over Salted Hash (in other words ...
7
votes
1
answer
11k
views
HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512
I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC.
I found this table in RFC5246:
...
4
votes
2
answers
2k
views
HMAC does it matter if I chose the cipher text or the plain text as the message? [duplicate]
I am using HMAC to create a message authentication code. My question is, does it matter if I use cipher text + encryption key or ...
3
votes
0
answers
53
views
Is this a more effective HMAC? [duplicate]
I was given an argument in a conversation today and I don't know how to respond to it:
H( k || m || k ) should be a better choice of MAC than the traditional HMAC. The person's rationale was that: "...
2
votes
1
answer
65
views
Signing different types of messages with the same asymmetric key
I want to be able to sign different types of messages with the same asymmetric key. (For completeness, I am using Ed25519 for my signatures).
Why do I want to do this?
The same key is used to sign ...
2
votes
1
answer
1k
views
HMAC SHA256 for deriving session keys using random nonce
I need to derive session key in order to create an application layer secure channel between mobile app and a bluetooth device. My scheme is similar to
this scheme that uses a HMAC and counter.
...
2
votes
1
answer
1k
views
Is transporting a salt, IV, ciphertext and HMAC in an encrypted token an acceptable practice?
I’m porting over some crypto code from Mcrypt (deprecated) to OpenSSL. I’m following a process that a former employee implemented, which is as follows:
Create a random salt for use in a PBKDF2 key ...
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
2
votes
2
answers
1k
views
What is a size of mac_length and mac_key_length for TLS cipher suites HMAC using SHA384 and SHA512?
i failed to find explicit definition of hash output size and mac_key_size for hmac based on SHA384 and SHA512.
RFC5246 specifies:
but defines only
3
votes
0
answers
205
views
How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?
I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes).
For ...
-1
votes
2
answers
498
views
Is HMAC a suitable substitute for HKDF?
My PHP version does not include the hash_hkdf() function, and upgrading versions is not worth the trouble for my project (which is for personal pleasure, not for ...
0
votes
1
answer
516
views
6 Byte for HMAC in wireless system secure?
A wireless system has 8 byte payload and 6 byte for message authentication.
Scheme:
...
3
votes
1
answer
513
views
Which one is better using DSA, or MAC and encryption?
I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA.
by using MAC, I required a shared key between ...
1
vote
0
answers
124
views
Tree structure with XTS and HMAC: MAC in parent
Situation:
A file format contains a tree-like data structure; parent nodes can find children and child nodes can also find their (single) parent. To protect confidentiality, the nodes in the file are ...
0
votes
1
answer
2k
views
MAC size 128 bits or more?
Just a quick question:
I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended.
Though when I looked up HMac to implement my own MAC in ...
2
votes
1
answer
53
views
Expanding truly random key into printable password for successive hashing
The STUN network protocol defines its client authorization in the terms of message-integrity check employing the following scheme [RFC5389, section 10.2]:
$$
\DeclareMathOperator{\HMAC}{HMAC}
\...
6
votes
1
answer
2k
views
Recommended key lengths for BLAKE2b
RFC 7693 provides the following table of standard parameter sets for BLAKE2b without a key (where nn is the hash size in bytes):
...
1
vote
1
answer
5k
views
Which algorithm has better performance (HMAC, UMAC, and Poly1305)?
I want to implement a protocol which requires Integrity and Authentication for its messages. I found a lot of algorithms such as HMAC, UMAC, and Poly1305 which provide Integrity and Authentication. So ...
1
vote
0
answers
53
views
MAC with key supplied afterwards
Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
0
votes
1
answer
76
views
Multikeyed Hash: known algorithms?
A MAC (or HMAC) can be represented by the general formula:
MAC = H(key, message)
I am calling "Multikeyed Hash" the operation (probably there exists already a ...
1
vote
0
answers
408
views
How many bits should I use for bearer tokens?
I'm in the process of developing a service that can be accessed with bearer tokens. Currently I'm using a random UUID converted into a URL safe format. That is 128 bits. Users will be authenticated ...
0
votes
1
answer
140
views
Security of using sha(secret + rand)
I have come across some security implementations in which party A will compute MD = sha256(secret + rand) and transmit MD and rand to a counterpart B. If the second party knows the secret, then when ...
0
votes
1
answer
2k
views
Doubt about the possible attacks on HMAC
I have a question about the security of HMAC:
If I know the value of the seed and the value of the HMAC but I don't know the key then I can't do the birthday attack because I can't generate an ...
1
vote
1
answer
1k
views
HMACSHA256 2.5 times faster than HMACSHA512
According to the answers to a previous question, the 512 version should be faster on x64 devices. And even if it were executed on an x86 (32 bit) device - there shouldn't be such a big difference.
...
0
votes
1
answer
137
views
Do I need to use HMAC in this crypto wallet backup application?
I'm building an application for securely backing up cryptocurrency private keys or 12-word backup phrases that crypto wallets use as a seed to generate private keys. For the purpose of this question, ...
4
votes
1
answer
139
views
Why would we want parallelizable authentication?
I believe that parallelizable authentication schemes are superior from an aesthetic perspective and because most non-recursive calculations (e.g., CTR, ECB, PMAC, etc.) are better than recursive ones (...
3
votes
2
answers
548
views
PBKDF2 with longer than native output length - Will hashing the result help?
I've seen it mentioned more than once that PBKDF2 should not be used to create a longer key than the native output (such as 160 bits when used with HMACSHA1). Since an attacker could test only the ...
2
votes
2
answers
1k
views
HMACSHA1 vs HMACSHA2 (for PBKDF2)
I need to choose an HMAC function for PBKDF2.
I'm using .net so I don't have the option to use SHA3. At first glance, and according to this answer by Thomas Pornin it seems like SHA512 would be best....
2
votes
1
answer
497
views
Do Message Digests protect public cryptography from replay attacks? [duplicate]
I read about HMAC and want to be sure if it protects against replay attacks as well.
9
votes
3
answers
19k
views
What's the difference between PBKDF2 and HMAC-SHA256 in security?
Being a software developer, I haven't dealt with crypto so far. So I know very little, sorry for that already.
I am aware that you should use bcrypt, scrypt, Argon2 or PBKDF2 for generating a hash ...
10
votes
1
answer
12k
views
HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication
Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
1
vote
1
answer
2k
views
Padding Oracle Attack with AES-128-CTR and MAC
Assume Alice and Bob are communicating using 'MAC then Encrypt' paradigm.
Specifically, they are using HMAC with SHA256 as the hash function and the output is truncated to 40 bits. They are using AES-...
0
votes
1
answer
147
views
What are the different uses of MAC and Digital Signature?
I know both of them can be used for Integrity and Authentication.
In which practical cases is preferred a MAC? and a Digital Signature?
Thank you in advance