Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
2
votes
1answer
54 views

Why there isn't a consistent key transform function of HMAC?

I am currently learning, the internal working of HMAC. There exists a key transformation process in the beginning, which works as follows:- Make the length of $K$ (Key) equal to $B$ (number of bits ...
3
votes
2answers
551 views

Setting MAC field to all-zero to indicate unencrypted data

I'm currently working on a project where we transmit data between two systems. The data is generally encrypted before transmission, however there are certain transmissions that are unencrypted. We ...
0
votes
0answers
55 views

Forge MAC given by Following Encryption

Hi i have a question about How to forge Mac like this. $$MAC=< C_0,C_l >$$ and $$C_0 = IV$$, IV is chosen randomly and $$C_i = E_k(C_{i-1} \oplus P_i )$$ I tried to give $$P = 0^n$$ then i will ...
2
votes
0answers
24 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
3
votes
0answers
60 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
1
vote
1answer
65 views

SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
1
vote
1answer
43 views

Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags(non-deterministic)?

If we use non-deterministic MACs in encrypt-and-authenticate approach, is it secure?
0
votes
1answer
37 views

What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?

I have messages with the following fixed lengths: 4 byte 8 byte 16 byte I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g....
0
votes
2answers
70 views

Who can create a MAC? Who can verify a MAC?

I have read many answers but I cannot get the basic explanation. There's no need for full details. I just need some basic information about who can create a mac and verify it.
1
vote
0answers
66 views

Proof of secure MAC [duplicate]

I'm studying about MAC and followings are definition of secure MAC. (This is Def 4.2 and Def 4.3 of "J.Katz and Y.Lindell-Introduction to Modern Cryptography") I want to prove this statement "There ...
1
vote
0answers
24 views

When extending the domain of a fixed-length MAC, why do we have to include the message length in each block?

In Katz's text (2nd edition), it states in 4.3.2: The truncation attack can be thwarted by additionally authenticating the message length along with each block. (Authenticating the message ...
0
votes
1answer
107 views

How does the squeeze function in the NaCl Poly1305 implementation work?

The NaCl ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()): ...
1
vote
1answer
72 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
1
vote
1answer
91 views

Hash for use in embedded HMAC application

I developed a GNSS logger (http://flysight.ca) which has become popular for scoring skydiving competitions. At the moment, there is little protection against competitors falsifying tracks, but I would ...
1
vote
0answers
64 views

A modification of the NMAC construction

Consider the NMAC construction: This is a proposed exercise in my notes: Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$? In ...
-1
votes
1answer
44 views

Length extension attack for file download

I am trying to understand the length extension attack. I found this tutorial where the author performs length extension on a file download URL. Original URL: http://example.com/download?file=...
3
votes
0answers
52 views

1-digit MAC with error-catching properties?

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
4
votes
2answers
113 views

Why is this MAC flawed?

Consider a function to create a tamperproof cookie as follows: $$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$ where $m$ is a message provided by Alice, and k is a secret key known only to ...
4
votes
1answer
83 views

Difficulty of forging MACs based on linear functions over $GF\left(2^n\right)$

This is a homework question, therefore I'm not expecting full solutions, just general guidance. I want to build a one-time MAC using universal hashing. I defined my hash functions as: $h_{a,b}:\...
0
votes
1answer
58 views

Two-way secret sharing for authentication?

Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ...
1
vote
1answer
85 views

Is this MAC correct and secure?

Let $m \in \{0, 1\}^{2n} = m_1 || m_2$. Let's also assume that $F_k$ is a PRF and $G$ is a PRG defined as $G: \{0, 1\}^n \rightarrow \{0, 1\}^n$. Now, Let's define the $MAC$ scheme as follows: $$MAC(...
1
vote
1answer
91 views

Is the scheme $(r, Mac_k(r) \oplus m)$ CPA-secure?

I honestly admit this question is taken from a h.w assignment: Prove or refute: the following encryption scheme is CPA-secure: Let $(\text{Gen}, \text{Mac}, \text{Vrfy})$ be a secure MAC with tags ...
4
votes
1answer
104 views

Are there any non Canonical Verifiable Cryptographic MACs

In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs; Canonical verification. For deterministic message authentication codes (that is, ...
4
votes
1answer
616 views

ISO 9797-1 MAC Algorithm 3 and Doc 9303-11 [closed]

I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 ...
0
votes
1answer
133 views

Show that if a fixed key MAC is not collision resistant then the MAC function is not computation resistant for every key K

I'm really having some trouble with this one. Let $H$ be a MAC function. For every key $K$ we can create an unkeyed hash function (i.e.an MDC) by using $H$ to hash messages with the fixed key $K$. ...
5
votes
2answers
273 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
0
votes
1answer
50 views

Can a Message Authenticaty Code recover original data from corrupted data?

I am new to cryptography and have been studying for Dan Boneh's Stanford Course on Coursera, after going through encrytpion and decryption I've started the integrity portion of the Course. Sir ...
2
votes
1answer
183 views

Is Strong MAC stronger than existential unforgeability?

Especially in the context of Encrypt-then-Authenticate.
1
vote
2answers
102 views

AES blocks with a counter

I would like to send small separate packets of data. I am thinking of using AES-128 or AES-256, and to add a counter as part of the plain text message. Some clarifications: Each message will be one ...
20
votes
1answer
3k views

Why is SHA-3 robust against Length-Extension Attacks?

If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?
2
votes
1answer
54 views

Why does bit padding work in practice in a message authentication code?

I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded. What I don't ...
1
vote
1answer
51 views

MAC and signatures

A message accompanied with a digital signature and a MAC. are there any possibility to know that the digital signature and the MAC are generated from the same message?
2
votes
1answer
98 views

AES ECB mode for both encryption and authentication

Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true? Encryption of exactly 128-bit (1 block) size messages Different keys used for both ...
1
vote
1answer
108 views

What cryptography primitives can help me (generate unforgeable tag)?

I have a read-only public bulletin board that It contains a series of information to form: $$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$ where $a_i\in\{0,1\}^...
2
votes
1answer
136 views

Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows: ...
1
vote
0answers
44 views

Parallel MAC vs doubled rounds for SipHash, KMAC and others

SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option. I was wondering from a security perspective how this would compare ...
0
votes
1answer
86 views

Challenging Question for the Build a Secure MAC with Special Properties

We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable. [Note that unsuccessful attempts to build such a scheme ...
-1
votes
1answer
80 views

Is this construction a secure MAC?

Let $F:\{ 0,1 \}^n \times \{ 0,1 \}^ n \rightarrow Z^*_q $ is a PRF, and $H:\{ 0,1 \}^{2n} \rightarrow \{ 0,1\}^n$ is a secure hash function. Is the following construction $\Pi=(Gen,Mac,Vrfy)$ is a ...
1
vote
3answers
590 views

Understanding MACs and why cleartext is sent over

Assume both Alice and Bob have a symmetrical key, let's call it $k$. They agree on a cryptographic hash function, let's call it $\mathsf{HASH}$. Now Alice wants to send an authenticated message. She ...
1
vote
2answers
347 views

Relationship between PRF/KDF/MAC?

It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
3
votes
1answer
164 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
0
votes
1answer
666 views

AES CBC MAC Generation

I am working with Atmel's/MicroChip's ATAES132A 32K AES Serial EEPROM chip for hardware encryption and decryption. This is my first venture into cryptography. I've been reading through the datasheet ...
3
votes
1answer
1k views

HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

I'm looking at three options for shared-secret message authentication codes: HMAC-SHA-256(secret, payload) SHA-512/256(secret+payload) SHA-512(secret+payload) truncated to 256 bits Option 1 is the ...
0
votes
1answer
47 views

What is the difference between verifying the hash value (MAC) and security provided by authenticated encryption?

I read this post Difference between MAC and Authenticated Encryption? but I'm still confusing the difference. Seems like MAC can guarantee both integrity and authenticity (tbh I dont know the ...
3
votes
3answers
287 views

Secure MAC and secure encryption schemes combined to form insecure Authenticated Encryption?

I'm reading up on Authenticated Encryption and can't really wrap my head around how a generally secure MAC and a generally secure encryption scheme can be combined into an insecure AE scheme, such as ...
6
votes
2answers
327 views

Proof that MAC and hash composition is insecure

Let $F$ be a secure PRF and $H$ a universal hash function. How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$ is an insecure MAC (or an insecure PRF, since a ...
2
votes
1answer
222 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
0
votes
1answer
138 views

Proof that MAC is insecure

I've just started studying MACs and I faced the following challenge: Let $F$ be a PRF over $(\mathcal{K,R,X})$ where $\mathcal{X} = \{0,1\}^{32}$ Let $\mathrm{CRC32}(m)$ be a function that takes ...
1
vote
1answer
58 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
1
vote
2answers
109 views

MAC attacks without knowing the key

Attacks on a MAC that do not require the discovery of the key are possible. Consider the following MAC algorithm. Let $M=(X_1\mathbin\|\dots\mathbin\|X_m)$ be a message that is treated as a ...