Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

0
votes
1answer
22 views

Is this MAC correct and secure?

Let $m \in \{0, 1\}^{2n} = m_1 || m_2$. Let's also assume that $F_k$ is a PRF and $G$ is a PRG defined as $G: \{0, 1\}^n \rightarrow \{0, 1\}^n$. Now, Let's define the $MAC$ scheme as follows: $$MAC(...
-2
votes
0answers
26 views

Does the following protocol provide Authenticy?

Alice: calculates and send $(m, \operatorname{SHA1}(key, m))$ Bob: receive the message and extract $m$, check the hash using the shared key Does this protocol integrity? Why is HMAC better than this ...
1
vote
1answer
63 views

Is the scheme $(r, Mac_k(r) \oplus m)$ CPA-secure?

I honestly admit this question is taken from a h.w assignment: Prove or refute: the following encryption scheme is CPA-secure: Let $(\text{Gen}, \text{Mac}, \text{Vrfy})$ be a secure MAC with tags ...
4
votes
1answer
72 views

Are there any non Canonical Verifiable Cryptographic MACs

In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs; Canonical verification. For deterministic message authentication codes (that is, ...
4
votes
1answer
43 views

ISO 9797-1 MAC Algorithm 3 and Doc 9303-11 [closed]

I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 ...
0
votes
1answer
63 views

Show that if a fixed key MAC is not collision resistant then the MAC function is not computation resistant for every key K

I'm really having some trouble with this one. Let $H$ be a MAC function. For every key $K$ we can create an unkeyed hash function (i.e.an MDC) by using $H$ to hash messages with the fixed key $K$. ...
5
votes
2answers
162 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
0
votes
0answers
42 views

Is there any MAC that satisfies UF-CMA but not UF-CMVA?

I need to find a simple MAC that satisfies UF-CMA but not UF-CMVA. A case in which Vrfy allows an Adversary to break the scheme.
0
votes
1answer
42 views

Can a Message Authenticaty Code recover original data from corrupted data?

I am new to cryptography and have been studying for Dan Boneh's Stanford Course on Coursera, after going through encrytpion and decryption I've started the integrity portion of the Course. Sir ...
2
votes
1answer
84 views

Is Strong MAC stronger than existential unforgeability?

Especially in the context of Encrypt-then-Authenticate.
1
vote
2answers
85 views

AES blocks with a counter

I would like to send small separate packets of data. I am thinking of using AES-128 or AES-256, and to add a counter as part of the plain text message. Some clarifications: Each message will be one ...
19
votes
1answer
3k views

Why is SHA-3 robust against Length-Extension Attacks?

If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?
2
votes
1answer
42 views

Why does bit padding work in practice in a message authentication code?

I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded. What I don't ...
1
vote
1answer
40 views

MAC and signatures

A message accompanied with a digital signature and a MAC. are there any possibility to know that the digital signature and the MAC are generated from the same message?
2
votes
1answer
65 views

AES ECB mode for both encryption and authentication

Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true? Encryption of exactly 128-bit (1 block) size messages Different keys used for both ...
1
vote
1answer
105 views

What cryptography primitives can help me (generate unforgeable tag)?

I have a read-only public bulletin board that It contains a series of information to form: $$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$ where $a_i\in\{0,1\}^...
2
votes
1answer
63 views

Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows: ...
1
vote
0answers
35 views

Parallel MAC vs doubled rounds for SipHash, KMAC and others

SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option. I was wondering from a security perspective how this would compare ...
0
votes
1answer
81 views

Challenging Question for the Build a Secure MAC with Special Properties

We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable. [Note that unsuccessful attempts to build such a scheme ...
-1
votes
1answer
67 views

Is this construction a secure MAC?

Let $F:\{ 0,1 \}^n \times \{ 0,1 \}^ n \rightarrow Z^*_q $ is a PRF, and $H:\{ 0,1 \}^{2n} \rightarrow \{ 0,1\}^n$ is a secure hash function. Is the following construction $\Pi=(Gen,Mac,Vrfy)$ is a ...
1
vote
3answers
554 views

Understanding MACs and why cleartext is sent over

Assume both Alice and Bob have a symmetrical key, let's call it $k$. They agree on a cryptographic hash function, let's call it $\mathsf{HASH}$. Now Alice wants to send an authenticated message. She ...
1
vote
2answers
164 views

Relationship between PRF/KDF/MAC?

It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
3
votes
1answer
96 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
0
votes
1answer
276 views

AES CBC MAC Generation

I am working with Atmel's/MicroChip's ATAES132A 32K AES Serial EEPROM chip for hardware encryption and decryption. This is my first venture into cryptography. I've been reading through the datasheet ...
3
votes
1answer
532 views

HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

I'm looking at three options for shared-secret message authentication codes: HMAC-SHA-256(secret, payload) SHA-512/256(secret+payload) SHA-512(secret+payload) truncated to 256 bits Option 1 is the ...
0
votes
1answer
44 views

What is the difference between verifying the hash value (MAC) and security provided by authenticated encryption?

I read this post Difference between MAC and Authenticated Encryption? but I'm still confusing the difference. Seems like MAC can guarantee both integrity and authenticity (tbh I dont know the ...
3
votes
3answers
147 views

Secure MAC and secure encryption schemes combined to form insecure Authenticated Encryption?

I'm reading up on Authenticated Encryption and can't really wrap my head around how a generally secure MAC and a generally secure encryption scheme can be combined into an insecure AE scheme, such as ...
5
votes
2answers
214 views

Proof that MAC and hash composition is insecure

Let $F$ be a secure PRF and $H$ a universal hash function. How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$ is an insecure MAC (or an insecure PRF, since a ...
2
votes
1answer
117 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
0
votes
1answer
92 views

Proof that MAC is insecure

I've just started studying MACs and I faced the following challenge: Let $F$ be a PRF over $(\mathcal{K,R,X})$ where $\mathcal{X} = \{0,1\}^{32}$ Let $\mathrm{CRC32}(m)$ be a function that takes ...
1
vote
1answer
30 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
1
vote
2answers
92 views

MAC attacks without knowing the key

Attacks on a MAC that do not require the discovery of the key are possible. Consider the following MAC algorithm. Let $M=(X_1\mathbin\|\dots\mathbin\|X_m)$ be a message that is treated as a ...
0
votes
1answer
37 views

Distinct MAC and Key for AEAD?

I am implementing some of the algorithms in RFC 7518 and I noticed that AES_CBC_HMAC_SHA2 contains the following paragraph: The secondary keys MAC_KEY and ENC_KEY are generated from the ...
0
votes
1answer
52 views

First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block. i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$ My question is,...
2
votes
1answer
85 views

Which one is better using DSA, or MAC and encryption?

I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA. by using MAC, I required a shared key between ...
1
vote
0answers
54 views

PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...
3
votes
1answer
79 views

MAC size: Should MAC be shorter than cipher block size?

Many sources claim that (if possible) a length of MAC should be as long as possible. So it should have the same size as size of the block of used cipher. However there is the following note in Bouncy ...
0
votes
1answer
248 views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
1
vote
1answer
193 views

Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
5
votes
1answer
236 views

Recommended key lengths for BLAKE2b

RFC 7693 provides the following table of standard parameter sets for BLAKE2b without a key (where nn is the hash size in bytes): ...
4
votes
1answer
395 views

Can keyed CRC be used as a MAC?

Consider a "MAC" that uses a symmetric key $K$ to generate an authentication tag $t$ for a message $M$ in the following way: Concatenate a timestamp with the message (to prevent replay attacks) $$ m =...
1
vote
0answers
44 views

MAC with key supplied afterwards

Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
1
vote
1answer
96 views

Is MAC required with Sign-then-Encrypt?

Consider a scenario where a message is sent encrypted and signed using public-key cryptography. When using asymmetric encryption, you end up also using symmetric encryption if the message is large (...
0
votes
1answer
43 views

Multikeyed Hash: known algorithms?

A MAC (or HMAC) can be represented by the general formula: MAC = H(key, message) I am calling "Multikeyed Hash" the operation (probably there exists already a ...
1
vote
1answer
62 views

Do you need to MAC an ECIES message?

Normally, when decrypting messages, you need to check if the message is authentic and integral (aka, never decrypt before checking the MAC). With ECIES, this seems to be done internally. Is it ...
1
vote
3answers
70 views

Does the Message Integrity Check in WPA(2) standard solve the problem of non-repudiation?

Whether the receiver can be sure that the message is sent by the source only and not spoofed by someone else?
0
votes
1answer
60 views

Encrypt than MAC scheme for Home Security system

Developing a wireless home security system based on STM32M0 µcontroller, I'm currently looking for the best way to manage encryption/authentication. For information, the STM32M0 has an AES hardware ...
0
votes
1answer
222 views

CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes. I would like to know what drawbacks/insecure caused by AES-...
4
votes
3answers
237 views

Why is SIV a thing if MAC-and-encrypt is not the most secure way to go?

The question that I am asking is exactly what I ask in the title.
4
votes
1answer
442 views

Encrypt-and-mac IND-CCA security

I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...