Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
1 vote
1 answer
32 views

Linear Message Authentication Codes

I am studying the message authentication codes introduced in this paper. These MACs are linear in the sense that, if $f(m,k)$ denotes the tag appended to the message $m$ when the agreed upon key is $k$...
aleph's user avatar
  • 111
3 votes
1 answer
98 views

Understanding CBC-MAC Algorithm and Nested Encryption

In the CBC-MAC algorithm as given in the image below, I have two questions: It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, ...
revision's user avatar
2 votes
1 answer
133 views

How do I generate a sequence of numbers with unpredictable differences

This question relates to bit flip attacks on OTP encrypted messages. Lets say I've got a list of numbers from 0 to 2^24-1 I want to re-order the list so it has the following property: If you start at ...
Drew's user avatar
  • 141
0 votes
0 answers
20 views

Reduction For MAC systems

I am not too knowledgeable regarding reductions for message authentication code encryption. Here is an example I found: There is a MAC' based on a preliminary existing MAC as such: MAC'(k, m) = MAC(k,...
sangaCat's user avatar
1 vote
2 answers
93 views

MAC question i got in a test, would like your opinion on my answer

Given a MAC secure scheme $(\text{Gen}, \text{Mac}, \text{Vrfy})$, a new scheme is suggested: $\text{Gen}' \rightarrow \text{Gen} = (pk_1, sk_1), \text{Gen} = (pk_2,sk_2)$ $\text{Mac}'(m) = (\text{...
binyamin alony's user avatar
0 votes
1 answer
80 views

Simplified MAC Algorithm

I would like to come up with a MAC algorithm that is simple and provably secure. The message and mac are OTP encrypted. For the purpose of this exercise lets say the entire plaintext is known to the ...
Drew's user avatar
  • 141
0 votes
0 answers
80 views

What is the simplest method of protecting a one time pad encrypted message from bit flip attacks?

I'm building a micro-controller based encryption device that uses one time pads. System details The reason I'm going this route is that I want a system which secure, but also very simple and easy to ...
Drew's user avatar
  • 141
0 votes
3 answers
87 views

Is it possible to construct a (pseudo-)continuous PRF or MAC?

Is it possible to construct an efficient-to-compute function $F: X \rightarrow Y$ such that Given samples $(x_1, F(x_1))...(x_n, F(x_n))$, any efficient adversary ($F$ itself is kept secret) can't ...
Marc_12's user avatar
  • 41
0 votes
0 answers
140 views

Known message attack on ENC-MAC with AES encryption

The assignment I have is as follows: Let $l=2^{128}$ and let $x$ be a random integer satisfying $0\le x \le l$ Let $\oplus $ be the XOR operator and $E_k$ an AES encryption with $key=k$ Let the ...
Danny Blozrov's user avatar
6 votes
2 answers
528 views

Message Authentication Code Padding Overview

I am confused about padding when using a Message Authentication Code (MAC). This paper suggests using a different key if the message is padded, and otherwise not, which really confused me. An example ...
Titanlord's user avatar
  • 2,309
3 votes
1 answer
173 views

Carter-Wegman MAC different notations

While studying Carter-Wegman message authentication codes MAC, I got two different notations for the broader concept and have problems with understanding the difference, if any exist. Let $K, K_1, K_2$...
Titanlord's user avatar
  • 2,309
4 votes
1 answer
134 views

Does the length extension attack apply to KDFs?

Older hash functions like SHA-256 and SHA-512 are vulnerable to the length extension attack, which is problematic in the context of a MAC. There are several ways to prevent this: Use a newer hash ...
samuel-lucas6's user avatar
1 vote
1 answer
80 views

Security of this MAC scheme

I'm studying for a cryptography exam, I have this question from a past exam: Consider the MAC with key $k$, based on a block cipher $E_{(k)}$ with block size $n$, and a collision-resistant hash ...
cantrell11's user avatar
0 votes
0 answers
77 views

Possible MAC design

The problem Let the following be a family of PRF functions with key length $2\lambda$ $$\mathbb{F} = \{F_k:\{0,1\}^n\rightarrow\{0,1\}^n\}_{k\in\{0,1\}^{2\lambda}}$$ Assuming one way functions exists, ...
zBION1C's user avatar
2 votes
1 answer
130 views

Is it safe to "sign" a message with such a zk proof

I am building an application in which I need to sign a message without revealing my entire identity. To do so, I just compute a zk proof with the following purpose: prove I own the secret key sk ...
Makubu's user avatar
  • 21
0 votes
1 answer
54 views

Long term Stream Cipher cipher text with MAC storage

Let's say I have x bytes of data that needs to be encrypted with Stream Ciphers such as AES256-CTR, ChaCha20, Salsa20, XChaCha20, XSalsa20. I would like to ask, since these ciphers typically requires ...
Hern's user avatar
  • 159
0 votes
2 answers
69 views

Can the secret and the message be switched in a mac? [duplicate]

A HMAC is usually said to be H(sk || msg) for some secret key sk and message msg. My first question is, can we compute it as H(msg || sk) instead ? Is there any drawbacks doing it ? If the answer is ...
Makubu's user avatar
  • 21
1 vote
0 answers
44 views

Short-input (<= 128 bit), short-output (<= 10 bit) MAC

I am faced with a problem of selecting an appropriate message authentication code (MAC) for a particular application. These are the constraints: I have two 64-bit integers $r_a$ and $r_s$ as input, ...
asnfkjsdx's user avatar
4 votes
0 answers
82 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
Nicole Foster's user avatar
0 votes
0 answers
48 views

Using AEAD as pure MAC with *only* associated data? [duplicate]

Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
pogoya9172's user avatar
1 vote
1 answer
54 views

Can MCOE AEAD mode be modified to work with Threefish tweak block cipher and generate intermediate tags

The MCOE mode provides a really nice way to implement a nonce-misuse resistant AEAD and is based on an arbitrary tweak block cipher. A specific requirement of the tweak block cipher is that the data ...
cookiecipher's user avatar
1 vote
2 answers
141 views

MAC from PRF secure under different restriction

Suppose, we have a secure PRF $F$. Then can there be a MAC Scheme $I=(Sign, Verify)$ using F such that $I$ is insecure, but I is secure under the restriction that all the queries for MAC challenges ...
John_cena's user avatar
2 votes
2 answers
179 views

A question about "attacks on MAC key space"

At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
hellobc's user avatar
  • 31
0 votes
0 answers
46 views

Parallelizable MAC/hash value stored securely

Assume the following: $E: \{0, 1\}^k \times \{0, 1\}^b \rightarrow \{0, 1\}^b$ is a block cipher with a $k$-bit key size and a $b$-bit block size. $T$ is a $b$-bit authentication tag that is ...
Melab's user avatar
  • 3,655
2 votes
1 answer
968 views

HMAC SHA256 walkthrough examples

I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully). I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc). Does anyone know of any ...
intrigued_66's user avatar
3 votes
1 answer
212 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
1 vote
1 answer
71 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
Melab's user avatar
  • 3,655
3 votes
1 answer
139 views

Verify HMAC tag without knowing the key

Let's say there's Alice and Bob. Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$. Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
tock203's user avatar
  • 345
6 votes
1 answer
819 views

Does the order of validations and MAC with clear text matter?

I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag. The question is whether the MAC should be validated first or if the fields are filled in ...
Felipe Rodriguez Fonte's user avatar
2 votes
1 answer
118 views

Does having more than one HMAC provide more information to the attacker?

Suppose $N$ many messages has been sent from $A$ to $B$ in this format: $\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$. Where $C(i)$ is some cipher-text encrypted with some secure algorithm using ...
CuriousCrypto's user avatar
0 votes
0 answers
81 views

Is my domain separation in stream cipher and MAC accepted?

I would like to implement domain separation in encryption/decryption along with MAC. The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
Hern's user avatar
  • 159
2 votes
1 answer
120 views

Paper based OTP and MAC

Consider the following paper based OTP Plaintext has 11 possible symbols 0-10. $C_i = M_i + K_i\ mod\ 11$. $K_i$ comes from a pre-shared key material which is never reused. How to introduce data ...
crypt's user avatar
  • 2,449
1 vote
0 answers
182 views

Quantum-Safe MAC: HMAC and CMAC

If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
bilaljo's user avatar
  • 163
3 votes
1 answer
258 views

Security of using key size larger than the message digest size in HMAC, with one time pads

I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption. One time pads for the message and the key of HMAC are ...
CuriousCrypto's user avatar
1 vote
0 answers
70 views

Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?

Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC $ Tag:\{0,1\}^\lambda \...
Giusy's user avatar
  • 33
2 votes
1 answer
960 views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
LUMPAAK's user avatar
  • 21
4 votes
0 answers
98 views

Practical attack on MD5(key || fixed-length-message) as MAC?

I wonder if there is any practical attack on MD5(key || fixed-length-message).
edo1's user avatar
  • 163
2 votes
1 answer
1k views

Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission

I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context: A message is ...
Joseph's user avatar
  • 123
2 votes
1 answer
102 views

Alternative definition of security for MAC

In the usual definition of security for message authentication codes, we let an adversary $A$ have access to an oracle for $Mac_k(.)$. However, if we consider that there exists a more powerful type of ...
Caio Nogueira's user avatar
1 vote
0 answers
150 views

AES-CBC-MAC forgery attack

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
MSCHA's user avatar
  • 11
3 votes
2 answers
599 views

Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?

Context I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
Ben Zelnick's user avatar
4 votes
1 answer
145 views

Can we achieve IND-CCA without a MAC?

In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in 2007 Authenticated Encryption: Relations among ...
kelalaka's user avatar
  • 48.7k
2 votes
1 answer
478 views

CPA secure to CCA secure encryption

Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
user104304's user avatar
1 vote
0 answers
166 views

Trying to understand this Solution related to CCA security

4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
Carlos73's user avatar
0 votes
1 answer
1k views

CBC-MAC Forge Attack Question

I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CryptoGuru's user avatar
1 vote
1 answer
82 views

Symmetric MAC benefit

I have a question about symmetric message authentication codes (MACs). Say Bob sends encrypted messages to Alice using a symmetric cipher. As I understand it: (1) Their threat model could or should ...
ElderlyPedant's user avatar
8 votes
1 answer
707 views

Is constant-time compare really required for AEAD ciphers?

When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
Maarten Bodewes's user avatar
1 vote
1 answer
215 views

How to know that MAC isn't modified in ECIES

I am new to ECC but I was wondering, If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
Kibnakamoto's user avatar
-1 votes
1 answer
127 views

Hash Function Vs Signature Vs MAC?

I read: What are the differences between a digital signature, a MAC and a hash? and Found this amazing answer: https://crypto.stackexchange.com/a/5647 But one question remains: I know that for huge ...
Daniel's user avatar
  • 1
1 vote
1 answer
789 views

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
Neil Yoga Crypto's user avatar

1
2 3 4 5
12