Questions tagged [mac]
(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.
559
questions
0
votes
0
answers
29
views
Verify HMAC tag without knowing the key
Let's say there's Alice and Bob.
Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$.
Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
- 315
6
votes
1
answer
809
views
Does the order of validations and MAC with clear text matter?
I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag.
The question is whether the MAC should be validated first or if the fields are filled in ...
2
votes
1
answer
84
views
Does having more than one HMAC provide more information to the attacker?
Suppose $N$ many messages has been sent from $A$ to $B$ in this format:
$\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$.
Where
$C(i)$ is some cipher-text encrypted with some secure algorithm using ...
0
votes
0
answers
63
views
Is my domain separation in stream cipher and MAC accepted?
I would like to implement domain separation in encryption/decryption along with MAC.
The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
- 125
2
votes
1
answer
100
views
Paper based OTP and MAC
Consider the following paper based OTP
Plaintext has 11 possible symbols 0-10.
$C_i = M_i + K_i\ mod\ 11$.
$K_i$ comes from a pre-shared key material which is never reused.
How to introduce data ...
- 2,377
1
vote
0
answers
92
views
Quantum-Safe MAC: HMAC and CMAC
If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
- 153
0
votes
0
answers
22
views
MAC Generation in ZUC: why is the test data non-byte aligned?
Short question: is there a particular reason why all standardized test data for the input message for 128-EIA3 is non-byte aligned?
- 1
3
votes
1
answer
145
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
1
vote
0
answers
39
views
Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?
Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC
$ Tag:\{0,1\}^\lambda \...
- 33
2
votes
1
answer
290
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 21
4
votes
0
answers
82
views
Practical attack on MD5(key || fixed-length-message) as MAC?
I wonder if there is any practical attack on MD5(key || fixed-length-message).
- 163
2
votes
1
answer
358
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 123
2
votes
1
answer
95
views
Alternative definition of security for MAC
In the usual definition of security for message authentication codes, we let an adversary $A$ have access to an oracle for $Mac_k(.)$. However, if we consider that there exists a more powerful type of ...
1
vote
0
answers
81
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
3
votes
2
answers
245
views
Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?
Context
I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
- 257
1
vote
1
answer
88
views
Can we achieve IND-CCA without a MAC?
In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in
2007 Authenticated Encryption: Relations among ...
- 46k
2
votes
1
answer
332
views
CPA secure to CCA secure encryption
Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
- 21
1
vote
0
answers
77
views
Trying to understand this Solution related to CCA security
4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
- 11
0
votes
1
answer
634
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
- 151
1
vote
1
answer
72
views
Symmetric MAC benefit
I have a question about symmetric message authentication codes (MACs).
Say Bob sends encrypted messages to Alice using a symmetric cipher. As I understand it:
(1) Their threat model could or should ...
8
votes
1
answer
613
views
Is constant-time compare really required for AEAD ciphers?
When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
- 90.2k
1
vote
1
answer
194
views
How to know that MAC isn't modified in ECIES
I am new to ECC but I was wondering,
If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
- 43
-1
votes
1
answer
84
views
Hash Function Vs Signature Vs MAC?
I read: What are the differences between a digital signature, a MAC and a hash?
and Found this amazing answer: https://crypto.stackexchange.com/a/5647
But one question remains:
I know that for huge ...
- 1
1
vote
1
answer
592
views
Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?
Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes,
And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
- 293
1
vote
1
answer
61
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 113
-1
votes
1
answer
82
views
Simplification: Should we MAC-then-encrypt or encrypt-then-MAC?
I refer to Should we MAC-then-encrypt or encrypt-then-MAC?.
There are 15 answers (today) with many words. It is difficult to tell which is the correct(?) answer. Also, the question excludes the ...
- 14.6k
1
vote
2
answers
153
views
What is more efficient to Encrypt then MAC or to MAC then encrypt
I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
- 13
0
votes
1
answer
70
views
Short description of encryption methods? [closed]
I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them.
Hash then encrypt
MAC then encrypt
Encrypt and MAC
Encrypt then MAC
- 1
1
vote
0
answers
126
views
CBC MAC forgery [duplicate]
$\text{CBC-MAC}$ is defined as follows:
$\text{CBC-MAC}_k() = IV $
$\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$
My lecture notes say that this is ...
- 151
0
votes
1
answer
102
views
Why is a weakly secure MAC without verification queries not necessarily weakly secure in the presence of verification queries?
I'm self-studying cryptography from A Graduate Course in Applied Cryptography by Boneh and Shoup (version 0.5), and I'm having trouble seeing the result in Exercise 6.7.
In the book a secure MAC ...
- 1
1
vote
0
answers
69
views
Can you use Output Feedback Mode (OFB) to construct a Message Authentication Code (MAC)
Suppose $f_k$ is an arbitrary block cipher. Can OFB via $f_k$ be used to make a MAC. I argue that you can't even with fixed l, $m = l \times k$ because in OFB, $\mu = f_k(f_k(...((IV))) \oplus m$, and ...
- 41
3
votes
1
answer
141
views
What is the purpose of the WireGuard handshake mac1 field?
The mac1 field in the WireGuard handshake messages is populated as:
...
1
vote
1
answer
99
views
MAC vs MDC when using ECDH+ECDSA in OpenPGP
I intend to design a model to comply with RFC4880.
According to RFC6637, ECC in OpenPGP
+ECDSA to sign message
+ECDH + KeyWrap for session key encryption
-MAC: is used for key confirmation (with C(1e, ...
- 51
0
votes
0
answers
29
views
Has reducing MAC size and increasing message size the same effect on security?
I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
- 101
1
vote
0
answers
119
views
Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?
The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
- 111
1
vote
1
answer
169
views
Using Chaskey as a stream cipher
Chaskey (https://eprint.iacr.org/2014/386.pdf) is a a secure, compact and efficient MAC for embedded systems and has won many benchmarks. It is built using an Even-Mansour block cipher. This block ...
- 133
2
votes
1
answer
1k
views
Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?
TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM.
The TLS Cipher Suite Registry contains no cipher suites that use ...
- 4,532
7
votes
1
answer
569
views
TLS 1.3 - Why have no encrypt-then-MAC modes been specified?
I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
- 123
0
votes
1
answer
79
views
Hybrid Authentications
Is there a reason why we can't combine private key MAC with digital signature to get a hybrid authentication scheme?
Is it because of the computational assumptions that digital signatures have?
Edit: (...
- 21
0
votes
1
answer
68
views
Where can I find good practice questions for proofs by reduction?
I already have the Katz-Lindell textbook, but I also want some additional practice problems for security reductions for stuff like PRFs, MACs, digital signatures, private and public key schemes, and ...
- 43
3
votes
1
answer
144
views
Why does CBC-MAC(M) = CFB-MAC(M)?
I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
- 31
2
votes
0
answers
54
views
Designated verifier signature from Diffie–Hellman and a MAC
Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
- 206
1
vote
0
answers
108
views
Proof check: Forgery for a MAC
I'm looking at the MAC defined as follows: $$\text{Mac}_k(m)=\langle r,f_k(r\oplus m)\rangle $$ where $r$ is uniformly chosen at random (each time) and $f_k$ is a PRF. Vrfy is the canonical one. I'm ...
- 21
2
votes
1
answer
284
views
Proving a derived MAC is secure via reduction
I don't have a very specific question, but reductions have been a weaker suit of mine and I was wondering if there is a secure MAC scheme, and a derived MAC' that uses MAC but modifies it in some way, ...
- 43
1
vote
0
answers
178
views
What does a deterministic MAC actually mean? [closed]
Does a MAC that's deterministic mean it uses a PRF? Thanks for the help!
- 43
4
votes
1
answer
770
views
Is KMAC just SHA-3-256(KEY || message)
According to keccak strengths you have:
Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be ...
- 484
4
votes
1
answer
410
views
Is $H(k || m) \oplus k$ secure?
It is known that $H(k || m)$ (when using SHA1) is an insecure MAC function since it is vulnerable to hash length extension.
But what about $H(k || m) \oplus k$? A normal hash length extension seems to ...
- 55
0
votes
1
answer
231
views
Why are des-cbc-hmac and rc4-hmac-exp considered weak in kerberos?
Kerberos uses des-cbc-hmac (mac and encrypt) and rc4-hmac-exp based on md5 (mac and encrypt I think) in their encryptions.
Those encryptions are considered as weak and should not be used. Why are they ...
- 175
0
votes
0
answers
74
views
MAC Security - MAC verification queries
In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that an adversary that is also capable of requesting the challenger for verification queries (in addition to ...
- 1,068
5
votes
1
answer
438
views
Does hashing an ECB encryption with a strong hash function produce a secure MAC?
Does applying a strong hash function like SHA-256 to the ECB-encryption of a message (using some secret key $K$) produce a secure mac? For example, given a message $m$, would a simple mac construction ...
- 309