Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
0
votes
0answers
6 views

Mac-sforge motivation for storing pairs

I don't understand why Q keeping pairs of instead of m like mac-forge solves the problem of generating a new tag on a previously authenticated message. Say, a previously authenticated message for "...
0
votes
1answer
30 views

How can I get VMAC Code in pure c?

I had find a paper about VMAC algorithm:VMAC: Message Authentication Code using Universal Hashing. Now I want to implement this algorithm, But i don't find test vectors about it. Who can give some ...
1
vote
0answers
35 views

Implementing MAC with PRF family $f$, why do we need $f_k$ to be invertible?

As per the title, say we have $\text{MAC}(k,m) = (m,f_k(m))$ where $f$ is a PRF family and every function $f_k$ is PRP, where $f_k(m)$ and $f_k^{-1}(m)$ are efficiently computable. I proved that this ...
0
votes
0answers
30 views

Constructing a MAC

I want to create a secure MAC according to this definition: but it should not be secure if the adversary has access to a Vrfy(.,.) How do I go about this?
2
votes
1answer
32 views

How can an adversary use Mac(.) with a new key to compute a tag although this is not a query to Mac oracle?

I am having some troubles understanding the power of an adversary in attack against a MAC. In chapter 4 in Introduction of Modern Cryptography by Jonathan Katz and Yehuda Lindell, specifically in the ...
1
vote
1answer
58 views

Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...
1
vote
2answers
103 views

Can a MAC be used as a HMAC?

I am reading through an information security book right now, and a confusing question poses itself to me: "Could you use a MAC as a HMAC? That is, does a MAC satisfy the same properties that a ...
8
votes
1answer
1k views

How many codes can I safely generate using the same HMAC key?

Can an attacker guess the key given enough codes for the same key? And if so, how many times is it safe to use the same key?
1
vote
1answer
41 views

Difference between MAC(key, msg) and SHA(key || msg)

I know that SHA(key || msg) is vulnerable to string concatenation attack. However, what if we specified key bit-length and msg bit-length? For example, key bit-length is 256 bit and msg bit-length is ...
1
vote
1answer
38 views

Using Poly1305 MAC key multiple times

I know that for Poly1305-ChaCha20 reusing the key does reveal information about the plaintext. How it is for the Poly1305 MAC algorithm? Revealing information about the plaintext is not a problem at ...
0
votes
1answer
50 views

Replay attack resistant MAC?

I came up with a threat model where: Alice and Bob agree on a shared key $K$ Alice sends a plain text $M$ and its $\operatorname{MAC}$ tag, $T = \operatorname{MAC}(K,M)$ to Bob over an untrusted ...
3
votes
1answer
81 views

Insecure MAC built on pseudorandom function

this is a question about Katz-Lindell book, introduction to modern cryptography, 2nd edition, exercise 4.7, part c. For (a) and (b) it is clear that the Macs are insecure, but for (c) I am struggling ...
0
votes
0answers
34 views

How to forge a signature in a custom PMAC implementation

From a crypto challenge i have the following PMAC variant where the task is to forge a signature to fulfil a specific condition: Preparation: in the finite Field GF(2^128) with the polynomial x^128 + ...
2
votes
1answer
63 views

Can poly1305 be used as an error-correction code?

Given a message $m$ of size $n$, a key $k$, and a message authentication code $mac = poly1305(m, k)$ what is the minimum amount of bitflips on the message that can be corrected (or at least detected) ...
-3
votes
1answer
93 views

The output size is smaller than input size is a insecure to hash function [closed]

Why it will be unsafe, and can be break?
2
votes
0answers
35 views

Attackability of one-time MAC when using block mode

Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially....
0
votes
0answers
40 views

XORing Algorithm Outputs To Guard Against Breakthroughs

My question is how safe is XORing two algorithm outputs together... ...For Symmetric Encryption: Master key from CSPRNG ==> MK HKDF-Expand(...
0
votes
1answer
105 views

Composition of X25519+XSalsa20+Poly1305

In an correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
1
vote
1answer
54 views

Attack on envelop mac

As I am reading the Paper: MDx-MAC and building fast MACs from hash functions I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...
1
vote
0answers
43 views

Circular Security - Encrypting the key with the key

I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
2
votes
1answer
71 views

Can we get the msg when we know tag and key in Poly1305

Assume $tag[i]=\operatorname{MAC}(key[i],msg)$ Now we know: $tag[0],tag[1],\ldots,tag[n]$ $key[0],key[1],\ldots,key[n]$ Can we get the $msg$ from this? Or can we get the $tag$ of this $msg$ using ...
1
vote
1answer
35 views

Signature over MAC value for a random key

Would it be possible to create a signature scheme like this: $ \DeclareMathOperator{Gen}{Gen_{\Mac}} \DeclareMathOperator{Mac}{Mac} \DeclareMathOperator{Sign}{Sign} \DeclareMathOperator{F}{F} \...
2
votes
1answer
42 views

Non Repudiation - Message Authentications methods

According to a definition given by my professor: Message authentication methods verify that the message is from the right sender, however they don't guarantee non-repudiation. To me this sounds ...
0
votes
1answer
30 views

Would a non-envelop, prefix only, SHA2 built MAC be susceptible to key recovery attacks?

When aiming to build a MAC, classic literature discusses the use of Envelopes or key "Sandwich" to build MACs. These were proved to be as secure as HMAC in “Sandwich” Is Indeed Secure: How to ...
1
vote
1answer
58 views

Does the ability to influence the key of a MAC effects its security?

If a PPT adversary can influence the key of a MAC function, is it still secure? For example, if we define $f$ as follow: $f(r,x) = HMAC_{(k\oplus r)}$(x) If the adversary has oracle access to $f$, ...
2
votes
1answer
89 views

Existence of MAC implies existence of OWF

I'm having trouble understanding how the existence of a MAC implies the existence of an OWF. If the MAC protocol is $(\operatorname{Gen}, \operatorname{MAC}, \operatorname{Ver})$ such that for any ...
1
vote
0answers
78 views

Generating a MAC on a Polynomial

In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
1
vote
1answer
44 views

Is it safe to compute HMAC(Base64(IV) || “,” || Base64(CipherText)) instead of HMAC(IV || CipherText)?

Let || be the concatenation operator. Let CipherText = AES(Key1, IV, Message). Let us assume AES is used in CBC mode. I want ...
0
votes
0answers
44 views

Is attack against secret prefix possible for messages of any size?

I am aware of message extension attack on MACs constructed with a hash function that uses Merkle-Damgård scheme. $$MAC=h(k,x)$$ I am interested if this attack only works if $0 ≡ x$ mod (hash input ...
1
vote
1answer
143 views

How are AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M related?

I am using OpenSSL 1.1.1 to implement a TLS 1.3 communication module so I tried to learn how data integrity and authentication is ensured. I read a lot about AEAD, GCM, CBC, Poly1305, EtM, MtE and E&...
1
vote
1answer
47 views

XCBC Authentication

So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
0
votes
0answers
43 views

Differences between MAC and HMAC [duplicate]

After reading many posts, I am still confused about the differences between these two. Let me know if my understanding is correct: MAC is encrypted string that is generated using a secret key and a ...
2
votes
2answers
129 views

Parallelizing MACs by subdividing the message and then aggregating results

Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC. Could these be securely parallelized by computing multiple MACs in parallel and then combining the ...
0
votes
1answer
81 views

Which HMAC scheme more secure?

Which HMAC scheme is more secure? Or are they of the same level of security? Scheme One Compute a HMAC on the data to encrypt (cleartext/plaintext) Encrypt the data with AES_CTR_256, and append ...
0
votes
1answer
104 views

Is using the same MAC twice insecure?

I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key. Here is the full recipe: Compute a HMAC on the data to encrypt, and append it to the ...
2
votes
0answers
76 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
2
votes
1answer
124 views

Zero Knowledge Proofs: to establish a public key cryptography encryption

I am very interested to know in the general sense how two parties who know each other are able to continue a conversation IF and ONLY IF they both earn the same salary. For example, we have a person X ...
2
votes
2answers
189 views

Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?

Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
0
votes
1answer
45 views

specific scenario question relating to using NACL crypto_box in a protocol

Scenario 1: SenderA sends message1 to ReceiverB message1 is encrypted using NACL crypto_box using SenderA secret key and ReceiverB public key. we understand that the NACL crypto_box authenticator ...
0
votes
1answer
130 views

How to decide whether to use digital signature (RSA) or HMAC

I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other? These are some examples: HMAC SHA256 vs RSA SHA256 - which one to use What are the ...
0
votes
1answer
70 views

It is the IV shared in CBC mode?

I don't know if the IV in CBC mode is equal in both sides of the encryption and decryption operations. I know that the IV must be unpredictable, but has it to be MACed in the encryption side to be ...
2
votes
1answer
83 views

Why there isn't a consistent key transform function of HMAC?

I am currently learning, the internal working of HMAC. There exists a key transformation process in the beginning, which works as follows:- Make the length of $K$ (Key) equal to $B$ (number of bits ...
3
votes
2answers
570 views

Setting MAC field to all-zero to indicate unencrypted data

I'm currently working on a project where we transmit data between two systems. The data is generally encrypted before transmission, however there are certain transmissions that are unencrypted. We ...
2
votes
0answers
44 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
3
votes
0answers
69 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
2
votes
1answer
134 views

SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
1
vote
1answer
76 views

Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags(non-deterministic)?

If we use non-deterministic MACs in encrypt-and-authenticate approach, is it secure?
0
votes
1answer
108 views

What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?

I have messages with the following fixed lengths: 4 byte 8 byte 16 byte I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g....
0
votes
2answers
75 views

Who can create a MAC? Who can verify a MAC?

I have read many answers but I cannot get the basic explanation. There's no need for full details. I just need some basic information about who can create a mac and verify it.
1
vote
0answers
281 views

Proof of secure MAC [duplicate]

I'm studying about MAC and followings are definition of secure MAC. (This is Def 4.2 and Def 4.3 of "J.Katz and Y.Lindell-Introduction to Modern Cryptography") I want to prove this statement "There ...

1
2 3 4 5
9