Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
2
votes
1answer
51 views

ISO 9797 MAC algorithm 3 for 7 bytes

I should implement ISO 9797 MAC algorithm 3 with initial transformation 1, without truncation, and using DES as a block cipher. I should add padding of 0x80, then ...
0
votes
0answers
34 views

Digital Signature or MAC Yielding Non-Binary Verification Predicate

Is there a digital signature or MAC scheme in which, the verification algorithm returns not $\{\text{Valid},\text{Invalid}\}$, but a discrete (finite or infinite) set of result such as $\{\text{Valid-...
1
vote
2answers
190 views

Why is a MAC verification algorithm required when we can simply create a new MAC and compare the received one with the one calculated?

The process of verifying integrity through MAC involves two separate algorithms (as mentioned here). On the server side, a signing algorithm runs which calculates ...
0
votes
1answer
39 views

Design flaws when designing a MAC-function

Suppose we want to build a very basic hash function like this: $$c_i = h(c_{i-1},x_i) = c_{i-1}\oplus x_i \quad\quad mit \;\; i\geq1, c_0 = \operatorname{IV}$$ Now suppose we'd use this hash-function ...
5
votes
3answers
149 views

What are the benefits of using AEAD algorithms as MAC

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...
1
vote
2answers
362 views

Is it fair to say that MACs use a signing algorithm?

The Wikipedia page on MAC calls the algorithm that is used to generate the MAC as a signing algorithm. Is that a fair use of that term? Can we then say that HMAC-SHA-1 uses SHA-1 as the signing ...
2
votes
1answer
80 views

Why Authenticated Encryption the same message again is not secure?

It is the Exercise 9.14 (9.1) from the book A graduate course in applied cryptography by Boneh and Shoup. Let $(E, D)$ be an AE-secure cipher. a. $E_1(k,m):=(E(k,m), E(k,m));$ $$D_1(k,(c_1,c_2)):= ...
0
votes
1answer
28 views

Is MAC process different for symmetric and asymmetric?

Message Authentication Code as far as I know works on the shared secret key. Do they work in the same way. Is there no difference between symmetric and asymmetric processes. Can anyone please explain ...
0
votes
0answers
9 views

Extract Certificates from Package File on Mac

I would like to manually verify the certificate chain on a package from my MacOS Catalina. I know that you can use the codesign --extract-certificates to extract certificates from applications, but I ...
2
votes
0answers
63 views

Is a car odometer reading protected by MAC? [closed]

I knew the reading on a car odometer can be easily modified with the help of some softwares. But isn't there MAC to protect the reading from being modified?
2
votes
1answer
73 views

CBC encryption + CBC MAC reusing key in MAC-then-Encrypt

I'm reading the Handbook of Applied Cryptography by ‎Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure. My ...
0
votes
2answers
79 views

If I want Integrity and Authentication AND Non-Repudiation, can the Digital Signature be based on the MAC?

Let's say I'm making a digital signature like this: hash = hash(message) digital signature = encrypt_with_private_key(hash) where the private key is Alice's ...
12
votes
3answers
3k views

What happened to Poly1305AES? Is it obsolete?

I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, ...
0
votes
1answer
57 views

MAC security game

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that one can modify SUF-CMA game by removing verify oracle access to the adversary. Therefore, the two versions are ...
-1
votes
1answer
32 views

how to predict a sequence for reverse engineering of a ticketing system [closed]

i am student in the fith year of college IT-science and a crypto noob. i have been wondering how the folwing sequence of ticket i bougth in all at once were built for : how they work or how they are ...
1
vote
1answer
72 views

How do the signatures or message authentication codes achieve the authenticity, integrality or non-repudiation?

Actually, I want to know whether there are explicit and formal definitions of the properties which are authenticity, integrality or non-repudiation. It seems that the signatures and MACs can achieve ...
0
votes
1answer
24 views

Mac-sforge motivation for storing pairs

I don't understand why Q keeping pairs of instead of m like mac-forge solves the problem of generating a new tag on a previously authenticated message. Say, a previously authenticated message for "...
0
votes
1answer
43 views

How can I get VMAC Code in pure c?

I had find a paper about VMAC algorithm:VMAC: Message Authentication Code using Universal Hashing. Now I want to implement this algorithm, But i don't find test vectors about it. Who can give some ...
1
vote
0answers
38 views

Implementing MAC with PRF family $f$, why do we need $f_k$ to be invertible?

As per the title, say we have $\text{MAC}(k,m) = (m,f_k(m))$ where $f$ is a PRF family and every function $f_k$ is PRP, where $f_k(m)$ and $f_k^{-1}(m)$ are efficiently computable. I proved that this ...
2
votes
1answer
40 views

How can an adversary use Mac(.) with a new key to compute a tag although this is not a query to Mac oracle?

I am having some troubles understanding the power of an adversary in attack against a MAC. In chapter 4 in Introduction of Modern Cryptography by Jonathan Katz and Yehuda Lindell, specifically in the ...
1
vote
1answer
147 views

Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...
1
vote
2answers
115 views

Can a MAC be used as a HMAC?

I am reading through an information security book right now, and a confusing question poses itself to me: "Could you use a MAC as a HMAC? That is, does a MAC satisfy the same properties that a ...
8
votes
1answer
1k views

How many codes can I safely generate using the same HMAC key?

Can an attacker guess the key given enough codes for the same key? And if so, how many times is it safe to use the same key?
1
vote
1answer
49 views

Difference between MAC(key, msg) and SHA(key || msg)

I know that SHA(key || msg) is vulnerable to string concatenation attack. However, what if we specified key bit-length and msg bit-length? For example, key bit-length is 256 bit and msg bit-length is ...
1
vote
1answer
56 views

Using Poly1305 MAC key multiple times

I know that for Poly1305-ChaCha20 reusing the key does reveal information about the plaintext. How it is for the Poly1305 MAC algorithm? Revealing information about the plaintext is not a problem at ...
1
vote
1answer
92 views

Replay attack resistant MAC?

I came up with a threat model where: Alice and Bob agree on a shared key $K$ Alice sends a plain text $M$ and its $\operatorname{MAC}$ tag, $T = \operatorname{MAC}(K,M)$ to Bob over an untrusted ...
3
votes
1answer
101 views

Insecure MAC built on pseudorandom function

this is a question about Katz-Lindell book, introduction to modern cryptography, 2nd edition, exercise 4.7, part c. For (a) and (b) it is clear that the Macs are insecure, but for (c) I am struggling ...
0
votes
0answers
38 views

How to forge a signature in a custom PMAC implementation

From a crypto challenge i have the following PMAC variant where the task is to forge a signature to fulfil a specific condition: Preparation: in the finite Field GF(2^128) with the polynomial x^128 + ...
2
votes
1answer
68 views

Can poly1305 be used as an error-correction code?

Given a message $m$ of size $n$, a key $k$, and a message authentication code $mac = poly1305(m, k)$ what is the minimum amount of bitflips on the message that can be corrected (or at least detected) ...
-3
votes
1answer
120 views

The output size is smaller than input size is a insecure to hash function [closed]

Why it will be unsafe, and can be break?
2
votes
0answers
37 views

Attackability of one-time MAC when using block mode

Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially....
0
votes
0answers
42 views

XORing Algorithm Outputs To Guard Against Breakthroughs

My question is how safe is XORing two algorithm outputs together... ...For Symmetric Encryption: Master key from CSPRNG ==> MK HKDF-Expand(...
1
vote
1answer
218 views

Composition of X25519+XSalsa20+Poly1305

In an correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
1
vote
1answer
57 views

Attack on envelop mac

As I am reading the Paper: MDx-MAC and building fast MACs from hash functions I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...
1
vote
0answers
47 views

Circular Security - Encrypting the key with the key

I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
2
votes
1answer
75 views

Can we get the msg when we know tag and key in Poly1305

Assume $tag[i]=\operatorname{MAC}(key[i],msg)$ Now we know: $tag[0],tag[1],\ldots,tag[n]$ $key[0],key[1],\ldots,key[n]$ Can we get the $msg$ from this? Or can we get the $tag$ of this $msg$ using ...
2
votes
1answer
43 views

Signature over MAC value for a random key

Would it be possible to create a signature scheme like this: $ \DeclareMathOperator{Gen}{Gen_{\Mac}} \DeclareMathOperator{Mac}{Mac} \DeclareMathOperator{Sign}{Sign} \DeclareMathOperator{F}{F} \...
2
votes
1answer
45 views

Non Repudiation - Message Authentications methods

According to a definition given by my professor: Message authentication methods verify that the message is from the right sender, however they don't guarantee non-repudiation. To me this sounds ...
0
votes
1answer
31 views

Would a non-envelop, prefix only, SHA2 built MAC be susceptible to key recovery attacks?

When aiming to build a MAC, classic literature discusses the use of Envelopes or key "Sandwich" to build MACs. These were proved to be as secure as HMAC in “Sandwich” Is Indeed Secure: How to ...
1
vote
1answer
58 views

Does the ability to influence the key of a MAC effects its security?

If a PPT adversary can influence the key of a MAC function, is it still secure? For example, if we define $f$ as follow: $f(r,x) = HMAC_{(k\oplus r)}$(x) If the adversary has oracle access to $f$, ...
2
votes
1answer
95 views

Existence of MAC implies existence of OWF

I'm having trouble understanding how the existence of a MAC implies the existence of an OWF. If the MAC protocol is $(\operatorname{Gen}, \operatorname{MAC}, \operatorname{Ver})$ such that for any ...
1
vote
0answers
80 views

Generating a MAC on a Polynomial

In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
1
vote
1answer
47 views

Is it safe to compute HMAC(Base64(IV) || “,” || Base64(CipherText)) instead of HMAC(IV || CipherText)?

Let || be the concatenation operator. Let CipherText = AES(Key1, IV, Message). Let us assume AES is used in CBC mode. I want ...
0
votes
0answers
44 views

Is attack against secret prefix possible for messages of any size?

I am aware of message extension attack on MACs constructed with a hash function that uses Merkle-Damgård scheme. $$MAC=h(k,x)$$ I am interested if this attack only works if $0 ≡ x$ mod (hash input ...
1
vote
1answer
201 views

How are AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M related?

I am using OpenSSL 1.1.1 to implement a TLS 1.3 communication module so I tried to learn how data integrity and authentication is ensured. I read a lot about AEAD, GCM, CBC, Poly1305, EtM, MtE and E&...
1
vote
1answer
52 views

XCBC Authentication

So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
0
votes
0answers
44 views

Differences between MAC and HMAC [duplicate]

After reading many posts, I am still confused about the differences between these two. Let me know if my understanding is correct: MAC is encrypted string that is generated using a secret key and a ...
2
votes
2answers
137 views

Parallelizing MACs by subdividing the message and then aggregating results

Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC. Could these be securely parallelized by computing multiple MACs in parallel and then combining the ...
0
votes
1answer
87 views

Which HMAC scheme more secure?

Which HMAC scheme is more secure? Or are they of the same level of security? Scheme One Compute a HMAC on the data to encrypt (cleartext/plaintext) Encrypt the data with AES_CTR_256, and append ...
0
votes
1answer
118 views

Is using the same MAC twice insecure?

I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key. Here is the full recipe: Compute a HMAC on the data to encrypt, and append it to the ...

1
2 3 4 5
10