Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
0 votes
0 answers
48 views

Using AEAD as pure MAC with *only* associated data? [duplicate]

Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
pogoya9172's user avatar
1 vote
1 answer
45 views

Can MCOE AEAD mode be modified to work with Threefish tweak block cipher and generate intermediate tags

The MCOE mode provides a really nice way to implement a nonce-misuse resistant AEAD and is based on an arbitrary tweak block cipher. A specific requirement of the tweak block cipher is that the data ...
cookiecipher's user avatar
1 vote
2 answers
108 views

MAC from PRF secure under different restriction

Suppose, we have a secure PRF $F$. Then can there be a MAC Scheme $I=(Sign, Verify)$ using F such that $I$ is insecure, but I is secure under the restriction that all the queries for MAC challenges ...
John_cena's user avatar
2 votes
2 answers
167 views

A question about "attacks on MAC key space"

At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
hellobc's user avatar
  • 21
0 votes
0 answers
44 views

Parallelizable MAC/hash value stored securely

Assume the following: $E: \{0, 1\}^k \times \{0, 1\}^b \rightarrow \{0, 1\}^b$ is a block cipher with a $k$-bit key size and a $b$-bit block size. $T$ is a $b$-bit authentication tag that is ...
Melab's user avatar
  • 3,635
2 votes
1 answer
261 views

HMAC SHA256 walkthrough examples

I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully). I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc). Does anyone know of any ...
intrigued_66's user avatar
3 votes
1 answer
148 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
1 vote
1 answer
69 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
Melab's user avatar
  • 3,635
3 votes
1 answer
98 views

Verify HMAC tag without knowing the key

Let's say there's Alice and Bob. Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$. Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
tock203's user avatar
  • 345
6 votes
1 answer
819 views

Does the order of validations and MAC with clear text matter?

I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag. The question is whether the MAC should be validated first or if the fields are filled in ...
Felipe Rodriguez Fonte's user avatar
2 votes
1 answer
95 views

Does having more than one HMAC provide more information to the attacker?

Suppose $N$ many messages has been sent from $A$ to $B$ in this format: $\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$. Where $C(i)$ is some cipher-text encrypted with some secure algorithm using ...
CuriousCrypto's user avatar
0 votes
0 answers
72 views

Is my domain separation in stream cipher and MAC accepted?

I would like to implement domain separation in encryption/decryption along with MAC. The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
Hern's user avatar
  • 125
2 votes
1 answer
111 views

Paper based OTP and MAC

Consider the following paper based OTP Plaintext has 11 possible symbols 0-10. $C_i = M_i + K_i\ mod\ 11$. $K_i$ comes from a pre-shared key material which is never reused. How to introduce data ...
crypt's user avatar
  • 2,397
1 vote
0 answers
145 views

Quantum-Safe MAC: HMAC and CMAC

If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
bilaljo's user avatar
  • 153
0 votes
0 answers
24 views

MAC Generation in ZUC: why is the test data non-byte aligned?

Short question: is there a particular reason why all standardized test data for the input message for 128-EIA3 is non-byte aligned?
Ellie's user avatar
  • 1
3 votes
1 answer
200 views

Security of using key size larger than the message digest size in HMAC, with one time pads

I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption. One time pads for the message and the key of HMAC are ...
CuriousCrypto's user avatar
1 vote
0 answers
61 views

Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?

Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC $ Tag:\{0,1\}^\lambda \...
Giusy's user avatar
  • 33
2 votes
1 answer
575 views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
LUMPAAK's user avatar
  • 21
4 votes
0 answers
92 views

Practical attack on MD5(key || fixed-length-message) as MAC?

I wonder if there is any practical attack on MD5(key || fixed-length-message).
edo1's user avatar
  • 163
2 votes
1 answer
814 views

Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission

I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context: A message is ...
Joseph's user avatar
  • 123
2 votes
1 answer
100 views

Alternative definition of security for MAC

In the usual definition of security for message authentication codes, we let an adversary $A$ have access to an oracle for $Mac_k(.)$. However, if we consider that there exists a more powerful type of ...
Caio Nogueira's user avatar
1 vote
0 answers
124 views

AES-CBC-MAC forgery attack

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
MSCHA's user avatar
  • 11
3 votes
2 answers
398 views

Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?

Context I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
Ben Zelnick's user avatar
2 votes
1 answer
122 views

Can we achieve IND-CCA without a MAC?

In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in 2007 Authenticated Encryption: Relations among ...
kelalaka's user avatar
  • 47.6k
2 votes
1 answer
413 views

CPA secure to CCA secure encryption

Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
user104304's user avatar
1 vote
0 answers
115 views

Trying to understand this Solution related to CCA security

4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
Carlos73's user avatar
0 votes
1 answer
1k views

CBC-MAC Forge Attack Question

I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CryptoGuru's user avatar
1 vote
1 answer
76 views

Symmetric MAC benefit

I have a question about symmetric message authentication codes (MACs). Say Bob sends encrypted messages to Alice using a symmetric cipher. As I understand it: (1) Their threat model could or should ...
ElderlyPedant's user avatar
8 votes
1 answer
658 views

Is constant-time compare really required for AEAD ciphers?

When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
Maarten Bodewes's user avatar
  • 91.7k
1 vote
1 answer
205 views

How to know that MAC isn't modified in ECIES

I am new to ECC but I was wondering, If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
Kibnakamoto's user avatar
-1 votes
1 answer
99 views

Hash Function Vs Signature Vs MAC?

I read: What are the differences between a digital signature, a MAC and a hash? and Found this amazing answer: https://crypto.stackexchange.com/a/5647 But one question remains: I know that for huge ...
Daniel's user avatar
  • 1
1 vote
1 answer
716 views

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
Neil Yoga Crypto's user avatar
1 vote
1 answer
69 views

How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream

I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
Grub's user avatar
  • 113
-1 votes
1 answer
93 views

Simplification: Should we MAC-then-encrypt or encrypt-then-MAC?

I refer to Should we MAC-then-encrypt or encrypt-then-MAC?. There are 15 answers (today) with many words. It is difficult to tell which is the correct(?) answer. Also, the question excludes the ...
Paul Uszak's user avatar
  • 15.1k
1 vote
2 answers
207 views

What is more efficient to Encrypt then MAC or to MAC then encrypt

I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
Cobb's user avatar
  • 13
0 votes
1 answer
71 views

Short description of encryption methods? [closed]

I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them. Hash then encrypt MAC then encrypt Encrypt and MAC Encrypt then MAC
Dylk58's user avatar
  • 1
1 vote
0 answers
128 views

CBC MAC forgery [duplicate]

$\text{CBC-MAC}$ is defined as follows: $\text{CBC-MAC}_k() = IV $ $\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$ My lecture notes say that this is ...
SVMteamsTool's user avatar
0 votes
1 answer
151 views

Why is a weakly secure MAC without verification queries not necessarily weakly secure in the presence of verification queries?

I'm self-studying cryptography from A Graduate Course in Applied Cryptography by Boneh and Shoup (version 0.5), and I'm having trouble seeing the result in Exercise 6.7. In the book a secure MAC ...
Ethan L's user avatar
1 vote
0 answers
74 views

Can you use Output Feedback Mode (OFB) to construct a Message Authentication Code (MAC)

Suppose $f_k$ is an arbitrary block cipher. Can OFB via $f_k$ be used to make a MAC. I argue that you can't even with fixed l, $m = l \times k$ because in OFB, $\mu = f_k(f_k(...((IV))) \oplus m$, and ...
amlearn369's user avatar
3 votes
1 answer
184 views

What is the purpose of the WireGuard handshake mac1 field?

The mac1 field in the WireGuard handshake messages is populated as: ...
undermountain's user avatar
1 vote
1 answer
128 views

MAC vs MDC when using ECDH+ECDSA in OpenPGP

I intend to design a model to comply with RFC4880. According to RFC6637, ECC in OpenPGP +ECDSA to sign message +ECDH + KeyWrap for session key encryption -MAC: is used for key confirmation (with C(1e, ...
Andy's user avatar
  • 61
0 votes
0 answers
32 views

Has reducing MAC size and increasing message size the same effect on security?

I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
Septatrix's user avatar
  • 101
1 vote
0 answers
130 views

Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?

The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
DodoDude700's user avatar
1 vote
1 answer
227 views

Using Chaskey as a stream cipher

Chaskey (https://eprint.iacr.org/2014/386.pdf) is a a secure, compact and efficient MAC for embedded systems and has won many benchmarks. It is built using an Even-Mansour block cipher. This block ...
Emil's user avatar
  • 133
2 votes
1 answer
2k views

Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?

TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM. The TLS Cipher Suite Registry contains no cipher suites that use ...
knaccc's user avatar
  • 4,712
7 votes
1 answer
760 views

TLS 1.3 - Why have no encrypt-then-MAC modes been specified?

I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
Keith's user avatar
  • 123
0 votes
1 answer
81 views

Hybrid Authentications

Is there a reason why we can't combine private key MAC with digital signature to get a hybrid authentication scheme? Is it because of the computational assumptions that digital signatures have? Edit: (...
paul lacher's user avatar
0 votes
1 answer
76 views

Where can I find good practice questions for proofs by reduction?

I already have the Katz-Lindell textbook, but I also want some additional practice problems for security reductions for stuff like PRFs, MACs, digital signatures, private and public key schemes, and ...
ness64's user avatar
  • 43
3 votes
1 answer
156 views

Why does CBC-MAC(M) = CFB-MAC(M)?

I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
user97599's user avatar
2 votes
0 answers
59 views

Designated verifier signature from Diffie–Hellman and a MAC

Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
kirelagin's user avatar
  • 206

1
2 3 4 5
12