Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
54 views

Simplification: Should we MAC-then-encrypt or encrypt-then-MAC?

I refer to Should we MAC-then-encrypt or encrypt-then-MAC?. There are 15 answers (today) with many words. It is difficult to tell which is the correct(?) answer. Also, the question excludes the ...
user avatar
  • 13.9k
1 vote
2 answers
69 views

What is more efficient to Encrypt then MAC or to MAC then encrypt

I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
user avatar
  • 13
0 votes
1 answer
57 views

Short description of encryption methods? [closed]

I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them. Hash then encrypt MAC then encrypt Encrypt and MAC Encrypt then MAC
user avatar
  • 1
1 vote
0 answers
34 views

CBC MAC forgery

$\text{CBC-MAC}$ is defined as follows: $\text{CBC-MAC}_k() = IV $ $\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$ My lecture notes say that this is ...
user avatar
0 votes
1 answer
62 views

Why is a weakly secure MAC without verification queries not necessarily weakly secure in the presence of verification queries?

I'm self-studying cryptography from A Graduate Course in Applied Cryptography by Boneh and Shoup (version 0.5), and I'm having trouble seeing the result in Exercise 6.7. In the book a secure MAC ...
user avatar
1 vote
0 answers
23 views

Can you use Output Feedback Mode (OFB) to construct a Message Authentication Code (MAC)

Suppose $f_k$ is an arbitrary block cipher. Can OFB via $f_k$ be used to make a MAC. I argue that you can't even with fixed l, $m = l \times k$ because in OFB, $\mu = f_k(f_k(...((IV))) \oplus m$, and ...
user avatar
2 votes
0 answers
34 views

What is the purpose of the WireGuard handshake mac1 field?

The mac1 field in the WireGuard handshake messages is populated as: ...
user avatar
0 votes
0 answers
20 views

Why EUF-CMA without verification oracle is not equivalent to EUF-CMA with verification oracle?

In the book we have talked about sEUF-CMA-secure with verification oracle being equivalent to sEUF-CMA-secure without verification oracle. The proof idea is simple. One direction is trivial. The other ...
user avatar
1 vote
1 answer
42 views

MAC vs MDC when using ECDH+ECDSA in OpenPGP

I intend to design a model to comply with RFC4880. According to RFC6637, ECC in OpenPGP +ECDSA to sign message +ECDH + KeyWrap for session key encryption -MAC: is used for key confirmation (with C(1e, ...
user avatar
  • 51
0 votes
0 answers
19 views

Has reducing MAC size and increasing message size the same effect on security?

I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
user avatar
  • 101
1 vote
0 answers
106 views

Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?

The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
user avatar
1 vote
1 answer
84 views

Using Chaskey as a stream cipher

Chaskey (https://eprint.iacr.org/2014/386.pdf) is a a secure, compact and efficient MAC for embedded systems and has won many benchmarks. It is built using an Even-Mansour block cipher. This block ...
user avatar
  • 133
1 vote
1 answer
239 views

Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?

TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM. The TLS Cipher Suite Registry contains no cipher suites that use ...
user avatar
  • 2,698
0 votes
0 answers
41 views

extend a MAC scheme to me unforgeable against unbounded queries

For some prime p we generate two keys $k_{1},k_{2} \leftarrow Z^2_{p}$ where $Z$ is group and the message space of the MAC is also $Z$. We generate a tag for ...
user avatar
6 votes
1 answer
308 views

TLS 1.3 - Why have no encrypt-then-MAC modes been specified?

I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
user avatar
  • 111
0 votes
1 answer
73 views

Hybrid Authentications

Is there a reason why we can't combine private key MAC with digital signature to get a hybrid authentication scheme? Is it because of the computational assumptions that digital signatures have? Edit: (...
user avatar
0 votes
1 answer
59 views

Where can I find good practice questions for proofs by reduction?

I already have the Katz-Lindell textbook, but I also want some additional practice problems for security reductions for stuff like PRFs, MACs, digital signatures, private and public key schemes, and ...
user avatar
  • 43
3 votes
1 answer
84 views

Why does CBC-MAC(M) = CFB-MAC(M)?

I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
user avatar
2 votes
0 answers
43 views

Designated verifier signature from Diffie–Hellman and a MAC

Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
user avatar
  • 196
1 vote
0 answers
61 views

Proof check: Forgery for a MAC

I'm looking at the MAC defined as follows: $$\text{Mac}_k(m)=\langle r,f_k(r\oplus m)\rangle $$ where $r$ is uniformly chosen at random (each time) and $f_k$ is a PRF. Vrfy is the canonical one. I'm ...
user avatar
  • 21
2 votes
1 answer
130 views

Proving a derived MAC is secure via reduction

I don't have a very specific question, but reductions have been a weaker suit of mine and I was wondering if there is a secure MAC scheme, and a derived MAC' that uses MAC but modifies it in some way, ...
user avatar
  • 43
1 vote
0 answers
76 views

What does a deterministic MAC actually mean? [closed]

Does a MAC that's deterministic mean it uses a PRF? Thanks for the help!
user avatar
  • 43
4 votes
1 answer
326 views

Is KMAC just SHA-3-256(KEY || message)

According to keccak strengths you have: Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be ...
user avatar
4 votes
1 answer
299 views

Is $H(k || m) \oplus k$ secure?

It is known that $H(k || m)$ (when using SHA1) is an insecure MAC function since it is vulnerable to hash length extension. But what about $H(k || m) \oplus k$? A normal hash length extension seems to ...
user avatar
0 votes
1 answer
89 views

Why are des-cbc-hmac and rc4-hmac-exp considered weak in kerberos?

Kerberos uses des-cbc-hmac (mac and encrypt) and rc4-hmac-exp based on md5 (mac and encrypt I think) in their encryptions. Those encryptions are considered as weak and should not be used. Why are they ...
user avatar
  • 175
0 votes
0 answers
50 views

MAC Security - MAC verification queries

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that an adversary that is also capable of requesting the challenger for verification queries (in addition to ...
user avatar
5 votes
1 answer
366 views

Does hashing an ECB encryption with a strong hash function produce a secure MAC?

Does applying a strong hash function like SHA-256 to the ECB-encryption of a message (using some secret key $K$) produce a secure mac? For example, given a message $m$, would a simple mac construction ...
user avatar
  • 229
0 votes
1 answer
139 views

What authenticated encryption do kerberos use in windows?

I have learned about the kerberos protocol and seen that the windows version uses a couple of authenticated encryption schemas (like rc4-hmac-md5). What type of authenticated encryption is it? Is it a:...
user avatar
  • 175
0 votes
0 answers
19 views

layout scheme to store encrypted files

I'm working on a little hobby project to better understand crypto. https://app.gitbook.com/@noojee/s/dvault/ The aim is to make it easy to encrypt a set of files into a 'vault' and decrypt them at a ...
user avatar
2 votes
1 answer
108 views

What benefit is gained when combining AES GCM/GMAC with ECDSA?

This is a real world question (and as I'm not an expert in cryptography I have only some basic knowledge in terms of just using it, not a deep understanding how ist works under the hood.): A system ...
user avatar
  • 1,447
2 votes
2 answers
119 views

AWS signature v4 key derivation

Generating Authorization header with AWS signature v4 involves deriving signing key as follows: https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html ...
user avatar
1 vote
1 answer
79 views

How to compose multiple values to MAC authenticate?

If the data I want to authenticate consists of multiple values and I compute a MAC simply concatenating the values, an adversary can "shift" characters within those values without ...
user avatar
2 votes
0 answers
138 views

Is the following derived MAC where the output is XOR'ed with the key secure?

Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck . More details: It's just any reduction ...
user avatar
0 votes
0 answers
44 views

Algorithm to validate 1 of N inputs is part of output hash

Is there an algorithm that allows proofing that an input x1 was used as 1 out of N inputs to create an output hash y, without ...
user avatar
  • 101
1 vote
0 answers
106 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
user avatar
  • 11
2 votes
1 answer
51 views

Is it possible to do partial message authentication?

I want to authenticate part of a message, not all of it, while creating the MAC over the entire message. Let's say I create a 16B MAC over one hundred message blocks that are 64B each. Then I send one ...
user avatar
1 vote
2 answers
78 views

Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? [closed]

Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size. ...
user avatar
  • 113
0 votes
0 answers
48 views

Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?

I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
user avatar
  • 1
2 votes
1 answer
90 views

Is the padding wrong on the "Length Extension Attack" Wikipedia page example?

In the Length extension attack of Wikipedia The following information summarizes the relevant information provided on the page at the time of posting this question. The provided parameters are secret ...
user avatar
  • 123
15 votes
5 answers
2k views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
user avatar
  • 253
0 votes
1 answer
130 views

Is the tag in a MAC scheme a fixed size?

I've been reading up on MAC schemes. But I cannot seem to find out whether the tag's that are output by running MAC(m) is of a fixed size? I can find a lot of stuff talking about the tag space being a ...
user avatar
1 vote
1 answer
166 views

Constructing a mac scheme secure to regular definition but insecure to special case

The mac-forge security game for mac schemes looks like this: $k \leftarrow \operatorname{Gen}(1^n)$; $(m,t) \leftarrow A^{\operatorname{MAC}_k(⋅)}(1^n)$; Let $Q$ denote the set of all queries that $A$...
user avatar
0 votes
1 answer
251 views

IND-CCA insecurity of modified CBC encrypt + MAC scheme

I've been puzzling over the following proof for the past couple of days. Since a block cipher in CBC mode can be used to build both an IND-CPA secure encryption scheme and a EUF-CMA secure block, a ...
user avatar
0 votes
0 answers
21 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
user avatar
  • 11
1 vote
2 answers
103 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
user avatar
1 vote
1 answer
251 views

Hash and (MAC) based signatures using zk-SNARK

I was wondering if we could use any general symmetric key MAC, a collision resistant hash $H$ and zk-SNARK (or any general NIZK scheme) to construct a signature scheme. I have a MAC key $k$, which is ...
user avatar
1 vote
0 answers
22 views

Is Poly1305 enough for cascading ciphers? [duplicate]

ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
user avatar
  • 421
1 vote
1 answer
63 views

Authentication tag length and post-quantum security

The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
user avatar
  • 11
1 vote
1 answer
198 views

HKDF Bit Security

I've always understood the bit security of hash functions to be related to their output size (eg. collision resistance). However, I recently came across a table from a Wickr blog post that lists HKDF-...
user avatar
  • 11
1 vote
0 answers
125 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
user avatar

1
2 3 4 5
11