Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

1
vote
1answer
14 views

SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
1
vote
1answer
38 views

Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags(non-deterministic)?

If we use non-deterministic MACs in encrypt-and-authenticate approach, is it secure?
-2
votes
0answers
72 views

Pseudorandom security & MAC

I have a pseudo-random function $\operatorname{F}$ with $\operatorname{MAC}\Pi_{F}^{2} = (\operatorname{Gen}, \operatorname{Enc}, \operatorname{Dec})$ where: $\operatorname{Gen}$ returns a long ...
0
votes
1answer
28 views

What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?

I have messages with the following fixed lengths: 4 byte 8 byte 16 byte I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g....
0
votes
2answers
67 views

Who can create a MAC? Who can verify a MAC?

I have read many answers but I cannot get the basic explanation. There's no need for full details. I just need some basic information about who can create a mac and verify it.
1
vote
0answers
65 views

Proof of secure MAC [duplicate]

I'm studying about MAC and followings are definition of secure MAC. (This is Def 4.2 and Def 4.3 of "J.Katz and Y.Lindell-Introduction to Modern Cryptography") I want to prove this statement "There ...
1
vote
0answers
24 views

When extending the domain of a fixed-length MAC, why do we have to include the message length in each block?

In Katz's text (2nd edition), it states in 4.3.2: The truncation attack can be thwarted by additionally authenticating the message length along with each block. (Authenticating the message ...
0
votes
1answer
96 views

How does the squeeze function in the NaCl Poly1305 implementation work?

The NaCl ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()): ...
1
vote
1answer
65 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
1
vote
1answer
89 views

Hash for use in embedded HMAC application

I developed a GNSS logger (http://flysight.ca) which has become popular for scoring skydiving competitions. At the moment, there is little protection against competitors falsifying tracks, but I would ...
1
vote
0answers
62 views

A modification of the NMAC construction

Consider the NMAC construction: This is a proposed exercise in my notes: Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$? In ...
-1
votes
1answer
43 views

Length extension attack for file download

I am trying to understand the length extension attack. I found this tutorial where the author performs length extension on a file download URL. Original URL: http://example.com/download?file=...
3
votes
0answers
52 views

1-digit MAC with error-catching properties?

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
4
votes
2answers
111 views

Why is this MAC flawed?

Consider a function to create a tamperproof cookie as follows: $$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$ where $m$ is a message provided by Alice, and k is a secret key known only to ...
4
votes
1answer
83 views

Difficulty of forging MACs based on linear functions over $GF\left(2^n\right)$

This is a homework question, therefore I'm not expecting full solutions, just general guidance. I want to build a one-time MAC using universal hashing. I defined my hash functions as: $h_{a,b}:\...
0
votes
1answer
52 views

Two-way secret sharing for authentication?

Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ...
1
vote
1answer
82 views

Is this MAC correct and secure?

Let $m \in \{0, 1\}^{2n} = m_1 || m_2$. Let's also assume that $F_k$ is a PRF and $G$ is a PRG defined as $G: \{0, 1\}^n \rightarrow \{0, 1\}^n$. Now, Let's define the $MAC$ scheme as follows: $$MAC(...
1
vote
1answer
89 views

Is the scheme $(r, Mac_k(r) \oplus m)$ CPA-secure?

I honestly admit this question is taken from a h.w assignment: Prove or refute: the following encryption scheme is CPA-secure: Let $(\text{Gen}, \text{Mac}, \text{Vrfy})$ be a secure MAC with tags ...
4
votes
1answer
102 views

Are there any non Canonical Verifiable Cryptographic MACs

In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs; Canonical verification. For deterministic message authentication codes (that is, ...
4
votes
1answer
455 views

ISO 9797-1 MAC Algorithm 3 and Doc 9303-11 [closed]

I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 ...
0
votes
1answer
128 views

Show that if a fixed key MAC is not collision resistant then the MAC function is not computation resistant for every key K

I'm really having some trouble with this one. Let $H$ be a MAC function. For every key $K$ we can create an unkeyed hash function (i.e.an MDC) by using $H$ to hash messages with the fixed key $K$. ...
5
votes
2answers
264 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
0
votes
1answer
47 views

Can a Message Authenticaty Code recover original data from corrupted data?

I am new to cryptography and have been studying for Dan Boneh's Stanford Course on Coursera, after going through encrytpion and decryption I've started the integrity portion of the Course. Sir ...
2
votes
1answer
170 views

Is Strong MAC stronger than existential unforgeability?

Especially in the context of Encrypt-then-Authenticate.
1
vote
2answers
98 views

AES blocks with a counter

I would like to send small separate packets of data. I am thinking of using AES-128 or AES-256, and to add a counter as part of the plain text message. Some clarifications: Each message will be one ...
20
votes
1answer
3k views

Why is SHA-3 robust against Length-Extension Attacks?

If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?
2
votes
1answer
49 views

Why does bit padding work in practice in a message authentication code?

I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded. What I don't ...
1
vote
1answer
48 views

MAC and signatures

A message accompanied with a digital signature and a MAC. are there any possibility to know that the digital signature and the MAC are generated from the same message?
2
votes
1answer
93 views

AES ECB mode for both encryption and authentication

Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true? Encryption of exactly 128-bit (1 block) size messages Different keys used for both ...
1
vote
1answer
108 views

What cryptography primitives can help me (generate unforgeable tag)?

I have a read-only public bulletin board that It contains a series of information to form: $$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$ where $a_i\in\{0,1\}^...
2
votes
1answer
127 views

Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows: ...
1
vote
0answers
42 views

Parallel MAC vs doubled rounds for SipHash, KMAC and others

SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option. I was wondering from a security perspective how this would compare ...
0
votes
1answer
85 views

Challenging Question for the Build a Secure MAC with Special Properties

We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable. [Note that unsuccessful attempts to build such a scheme ...
-1
votes
1answer
77 views

Is this construction a secure MAC?

Let $F:\{ 0,1 \}^n \times \{ 0,1 \}^ n \rightarrow Z^*_q $ is a PRF, and $H:\{ 0,1 \}^{2n} \rightarrow \{ 0,1\}^n$ is a secure hash function. Is the following construction $\Pi=(Gen,Mac,Vrfy)$ is a ...
1
vote
3answers
578 views

Understanding MACs and why cleartext is sent over

Assume both Alice and Bob have a symmetrical key, let's call it $k$. They agree on a cryptographic hash function, let's call it $\mathsf{HASH}$. Now Alice wants to send an authenticated message. She ...
1
vote
2answers
301 views

Relationship between PRF/KDF/MAC?

It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
3
votes
1answer
151 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
0
votes
1answer
596 views

AES CBC MAC Generation

I am working with Atmel's/MicroChip's ATAES132A 32K AES Serial EEPROM chip for hardware encryption and decryption. This is my first venture into cryptography. I've been reading through the datasheet ...
3
votes
1answer
1k views

HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

I'm looking at three options for shared-secret message authentication codes: HMAC-SHA-256(secret, payload) SHA-512/256(secret+payload) SHA-512(secret+payload) truncated to 256 bits Option 1 is the ...
0
votes
1answer
46 views

What is the difference between verifying the hash value (MAC) and security provided by authenticated encryption?

I read this post Difference between MAC and Authenticated Encryption? but I'm still confusing the difference. Seems like MAC can guarantee both integrity and authenticity (tbh I dont know the ...
3
votes
3answers
277 views

Secure MAC and secure encryption schemes combined to form insecure Authenticated Encryption?

I'm reading up on Authenticated Encryption and can't really wrap my head around how a generally secure MAC and a generally secure encryption scheme can be combined into an insecure AE scheme, such as ...
6
votes
2answers
313 views

Proof that MAC and hash composition is insecure

Let $F$ be a secure PRF and $H$ a universal hash function. How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$ is an insecure MAC (or an insecure PRF, since a ...
2
votes
1answer
179 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
0
votes
1answer
131 views

Proof that MAC is insecure

I've just started studying MACs and I faced the following challenge: Let $F$ be a PRF over $(\mathcal{K,R,X})$ where $\mathcal{X} = \{0,1\}^{32}$ Let $\mathrm{CRC32}(m)$ be a function that takes ...
1
vote
1answer
56 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
1
vote
2answers
106 views

MAC attacks without knowing the key

Attacks on a MAC that do not require the discovery of the key are possible. Consider the following MAC algorithm. Let $M=(X_1\mathbin\|\dots\mathbin\|X_m)$ be a message that is treated as a ...
0
votes
1answer
62 views

Distinct MAC and Key for AEAD?

I am implementing some of the algorithms in RFC 7518 and I noticed that AES_CBC_HMAC_SHA2 contains the following paragraph: The secondary keys MAC_KEY and ENC_KEY are generated from the ...
0
votes
1answer
108 views

First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block. i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$ My question is,...
2
votes
1answer
103 views

Which one is better using DSA, or MAC and encryption?

I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA. by using MAC, I required a shared key between ...
1
vote
0answers
72 views

PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...