Questions tagged [mac]
(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.
567
questions
0
votes
0
answers
48
views
Using AEAD as pure MAC with *only* associated data? [duplicate]
Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
1
vote
1
answer
45
views
Can MCOE AEAD mode be modified to work with Threefish tweak block cipher and generate intermediate tags
The MCOE mode provides a really nice way to implement a nonce-misuse resistant AEAD and is based on an arbitrary tweak block cipher.
A specific requirement of the tweak block cipher is that the data ...
- 307
1
vote
2
answers
108
views
MAC from PRF secure under different restriction
Suppose, we have a secure PRF $F$. Then can there be a MAC Scheme $I=(Sign, Verify)$ using F such that $I$ is insecure, but I is secure under the restriction that all the queries for MAC challenges ...
- 31
2
votes
2
answers
167
views
A question about "attacks on MAC key space"
At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence
For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
- 21
0
votes
0
answers
44
views
Parallelizable MAC/hash value stored securely
Assume the following:
$E: \{0, 1\}^k \times \{0, 1\}^b \rightarrow \{0, 1\}^b$ is a block cipher with a $k$-bit key size and a $b$-bit block size.
$T$ is a $b$-bit authentication tag that is ...
- 3,635
2
votes
1
answer
261
views
HMAC SHA256 walkthrough examples
I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully).
I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc).
Does anyone know of any ...
- 123
3
votes
1
answer
148
views
Does HMAC provide anything that AES GCM does not?
I would like to let the receiver has the ability to check the sender's authenticity when he gets the message.
Also, I want to protect the message's confidentiality and integrity.
Should I use ...
- 43
1
vote
1
answer
69
views
Is it undesirable for authentication to require decrypting a ciphertext?
A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
- 3,635
3
votes
1
answer
98
views
Verify HMAC tag without knowing the key
Let's say there's Alice and Bob.
Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$.
Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
- 345
6
votes
1
answer
819
views
Does the order of validations and MAC with clear text matter?
I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag.
The question is whether the MAC should be validated first or if the fields are filled in ...
2
votes
1
answer
95
views
Does having more than one HMAC provide more information to the attacker?
Suppose $N$ many messages has been sent from $A$ to $B$ in this format:
$\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$.
Where
$C(i)$ is some cipher-text encrypted with some secure algorithm using ...
0
votes
0
answers
72
views
Is my domain separation in stream cipher and MAC accepted?
I would like to implement domain separation in encryption/decryption along with MAC.
The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
- 125
2
votes
1
answer
111
views
Paper based OTP and MAC
Consider the following paper based OTP
Plaintext has 11 possible symbols 0-10.
$C_i = M_i + K_i\ mod\ 11$.
$K_i$ comes from a pre-shared key material which is never reused.
How to introduce data ...
- 2,397
1
vote
0
answers
145
views
Quantum-Safe MAC: HMAC and CMAC
If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
- 153
0
votes
0
answers
24
views
MAC Generation in ZUC: why is the test data non-byte aligned?
Short question: is there a particular reason why all standardized test data for the input message for 128-EIA3 is non-byte aligned?
- 1
3
votes
1
answer
200
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
1
vote
0
answers
61
views
Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?
Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC
$ Tag:\{0,1\}^\lambda \...
- 33
2
votes
1
answer
575
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 21
4
votes
0
answers
92
views
Practical attack on MD5(key || fixed-length-message) as MAC?
I wonder if there is any practical attack on MD5(key || fixed-length-message).
- 163
2
votes
1
answer
814
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 123
2
votes
1
answer
100
views
Alternative definition of security for MAC
In the usual definition of security for message authentication codes, we let an adversary $A$ have access to an oracle for $Mac_k(.)$. However, if we consider that there exists a more powerful type of ...
1
vote
0
answers
124
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
3
votes
2
answers
398
views
Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?
Context
I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
- 257
2
votes
1
answer
122
views
Can we achieve IND-CCA without a MAC?
In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in
2007 Authenticated Encryption: Relations among ...
- 47.6k
2
votes
1
answer
413
views
CPA secure to CCA secure encryption
Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
- 21
1
vote
0
answers
115
views
Trying to understand this Solution related to CCA security
4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
- 11
0
votes
1
answer
1k
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
- 161
1
vote
1
answer
76
views
Symmetric MAC benefit
I have a question about symmetric message authentication codes (MACs).
Say Bob sends encrypted messages to Alice using a symmetric cipher. As I understand it:
(1) Their threat model could or should ...
8
votes
1
answer
658
views
Is constant-time compare really required for AEAD ciphers?
When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
- 91.7k
1
vote
1
answer
205
views
How to know that MAC isn't modified in ECIES
I am new to ECC but I was wondering,
If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
- 53
-1
votes
1
answer
99
views
Hash Function Vs Signature Vs MAC?
I read: What are the differences between a digital signature, a MAC and a hash?
and Found this amazing answer: https://crypto.stackexchange.com/a/5647
But one question remains:
I know that for huge ...
- 1
1
vote
1
answer
716
views
Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?
Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes,
And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
- 293
1
vote
1
answer
69
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 113
-1
votes
1
answer
93
views
Simplification: Should we MAC-then-encrypt or encrypt-then-MAC?
I refer to Should we MAC-then-encrypt or encrypt-then-MAC?.
There are 15 answers (today) with many words. It is difficult to tell which is the correct(?) answer. Also, the question excludes the ...
- 15.1k
1
vote
2
answers
207
views
What is more efficient to Encrypt then MAC or to MAC then encrypt
I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
- 13
0
votes
1
answer
71
views
Short description of encryption methods? [closed]
I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them.
Hash then encrypt
MAC then encrypt
Encrypt and MAC
Encrypt then MAC
- 1
1
vote
0
answers
128
views
CBC MAC forgery [duplicate]
$\text{CBC-MAC}$ is defined as follows:
$\text{CBC-MAC}_k() = IV $
$\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$
My lecture notes say that this is ...
- 151
0
votes
1
answer
151
views
Why is a weakly secure MAC without verification queries not necessarily weakly secure in the presence of verification queries?
I'm self-studying cryptography from A Graduate Course in Applied Cryptography by Boneh and Shoup (version 0.5), and I'm having trouble seeing the result in Exercise 6.7.
In the book a secure MAC ...
- 1
1
vote
0
answers
74
views
Can you use Output Feedback Mode (OFB) to construct a Message Authentication Code (MAC)
Suppose $f_k$ is an arbitrary block cipher. Can OFB via $f_k$ be used to make a MAC. I argue that you can't even with fixed l, $m = l \times k$ because in OFB, $\mu = f_k(f_k(...((IV))) \oplus m$, and ...
- 51
3
votes
1
answer
184
views
What is the purpose of the WireGuard handshake mac1 field?
The mac1 field in the WireGuard handshake messages is populated as:
...
1
vote
1
answer
128
views
MAC vs MDC when using ECDH+ECDSA in OpenPGP
I intend to design a model to comply with RFC4880.
According to RFC6637, ECC in OpenPGP
+ECDSA to sign message
+ECDH + KeyWrap for session key encryption
-MAC: is used for key confirmation (with C(1e, ...
- 61
0
votes
0
answers
32
views
Has reducing MAC size and increasing message size the same effect on security?
I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
- 101
1
vote
0
answers
130
views
Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?
The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
- 111
1
vote
1
answer
227
views
Using Chaskey as a stream cipher
Chaskey (https://eprint.iacr.org/2014/386.pdf) is a a secure, compact and efficient MAC for embedded systems and has won many benchmarks. It is built using an Even-Mansour block cipher. This block ...
- 133
2
votes
1
answer
2k
views
Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?
TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM.
The TLS Cipher Suite Registry contains no cipher suites that use ...
- 4,712
7
votes
1
answer
760
views
TLS 1.3 - Why have no encrypt-then-MAC modes been specified?
I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
- 123
0
votes
1
answer
81
views
Hybrid Authentications
Is there a reason why we can't combine private key MAC with digital signature to get a hybrid authentication scheme?
Is it because of the computational assumptions that digital signatures have?
Edit: (...
- 21
0
votes
1
answer
76
views
Where can I find good practice questions for proofs by reduction?
I already have the Katz-Lindell textbook, but I also want some additional practice problems for security reductions for stuff like PRFs, MACs, digital signatures, private and public key schemes, and ...
- 43
3
votes
1
answer
156
views
Why does CBC-MAC(M) = CFB-MAC(M)?
I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
- 31
2
votes
0
answers
59
views
Designated verifier signature from Diffie–Hellman and a MAC
Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
- 206