Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
14
votes
5answers
2k views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
0
votes
1answer
42 views

Is the tag in a MAC scheme a fixed size?

I've been reading up on MAC schemes. But I cannot seem to find out whether the tag's that are output by running MAC(m) is of a fixed size? I can find a lot of stuff talking about the tag space being a ...
1
vote
1answer
72 views

Constructing a mac scheme secure to regular definition but insecure to special case

The mac-forge security game for mac schemes looks like this: $k \leftarrow \operatorname{Gen}(1^n)$; $(m,t) \leftarrow A^{\operatorname{MAC}_k(⋅)}(1^n)$; Let $Q$ denote the set of all queries that $A$...
0
votes
1answer
37 views

IND-CCA insecurity of modified CBC encrypt + MAC scheme

I've been puzzling over the following proof for the past couple of days. Since a block cipher in CBC mode can be used to build both an IND-CPA secure encryption scheme and a EUF-CMA secure block, a ...
0
votes
0answers
19 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
0
votes
0answers
20 views

Why doesn't appending a message to a key instead of vice versa defeat length extension attack? [duplicate]

It's well established that H(K||M) is vulnerable to length extension attacks for SHA-2 and other hashing algorithms, and instead an HMAC construction should be used. However - why can't H(M||K) be ...
1
vote
2answers
52 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
1
vote
1answer
97 views

Hash and (MAC) based signatures using zk-SNARK

I was wondering if we could use any general symmetric key MAC, a collision resistant hash $H$ and zk-SNARK (or any general NIZK scheme) to construct a signature scheme. I have a MAC key $k$, which is ...
1
vote
0answers
21 views

Is Poly1305 enough for cascading ciphers? [duplicate]

ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
0
votes
0answers
34 views

Authentication tag length and post-quantum security

The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
1
vote
1answer
77 views

HKDF Bit Security

I've always understood the bit security of hash functions to be related to their output size (eg. collision resistance). However, I recently came across a table from a Wickr blog post that lists HKDF-...
1
vote
0answers
59 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
0
votes
0answers
54 views

Insecure pseudo random functions

Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key): $(a)$ To authenticate a ...
2
votes
1answer
34 views

Corelating between the concept of Universal Hashing wrt Algorithms (hash-table use) & the use of Universal Hashing in a one-time MAC

Trying to understand the concept of a Universal Hashing function. From Introduction of Algorithms by Cormen, Rivest et al We now define the hash function $h_ab$ for any $a \in Z^*_p$ and any $b \in ...
0
votes
1answer
44 views

Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done

This is from Boneh's lecture ECBC-MAC Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
0
votes
0answers
46 views

How secure is Encrypt-And-MAC?

From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
2
votes
2answers
293 views

Is E_k(M)||H(m) form of MAC secure?

Would this encryption and signing scenario be considered tamper-proof? ...
2
votes
1answer
89 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
2
votes
1answer
108 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
2
votes
0answers
80 views

What is the original paper of the length extension attack on hash based MAC functions

A message authentication code (MAC) based on using a hash function with the secret prefix $H(k||m)$ technique goes back to two independent sources according to Tsudik's article on 1992; S. Crocker, S....
4
votes
2answers
158 views

MAC-then-encrypt in SIGMA protocol for authenticated key exchange

The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption. The SIGMA-I variant illustrated below ...
3
votes
1answer
171 views

CMAC - how is ambiguity resolved?

To avoid the dummy padding block, CMAC uses 2 separate keys K1 & K2. If padding is required, the final block is padded & then XORed with K1. If no padding is required, then it's XORed with K2. ...
3
votes
1answer
130 views

Can a CCA-secure cryptosystem be used as a CMA-secure MAC?

Can every CCA-secure cryptosystem be used as a CMA-secure MAC? I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it ...
0
votes
0answers
53 views

Constructing a no-query secure MAC II

I'm trying to construct a no-query-secure MAC $II=(Gen,Mac,Vrfy)$ without using any cryptographic primitives such as PRF, PRG, has function, etc. My-attempt: I learned that a message authentication ...
0
votes
0answers
36 views

Using AES to create a secured MAC

Considering public message M and private key K, would it be safe to create the MAC tag this way: $$MAC(M,K) = AES(m_1) \oplus AES(m_2) \oplus \cdots \oplus AES(m_n)$$ when $m_1,m_2,\ldots,m_n$ are n ...
1
vote
1answer
59 views

byte significance with hash functions

I am using the python hmac module to generate an authentication code. Given a key, message, and hash function (I am using md5), the library returns an authentication code as a python bytes object. I ...
1
vote
1answer
100 views

Are MAC algorithms and digital signatures secure from quantum computers? If not, why?

I understand that asymmetric encryption is fundamentally deemed useless under Shor's Algorithm, and understand that symmetric encryption is somewhat quantum-resistant as long as the key-length is ...
2
votes
1answer
60 views

Encrypting data with HMAC-SHA1 challenge response as the key

I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data. Generate a non-secret 64 byte random string $M$ (fixed challenge) Generate ...
0
votes
0answers
36 views

Do i need MAC if i sign the message with for example ed25519? [duplicate]

If I understand correctly MAC makes sure that the encrypted message isn't altered, so I presume signing the message with for example ed25519 would do the job too. Am I right?
1
vote
1answer
45 views

Given a collision in a MAC function, is it possible to work out how the MAC function works and generate valid MAC values for any message?

So given you can find a collision for any MAC value, would this be viable without knowing the key. Even if you couldn't figure out how that MAC function works, could you find valid MAC values for a ...
2
votes
1answer
59 views

MAC forgery using the DES's Complementary Property

I've started reading on MACs and working on a problem where given a MAC construction as $H_0=IV$ and for every $i>0$ $H_i=H_{i−1} \oplus E_{M[i]}(H_{i−1})$ and the tag is $(IV,E_{k_1}(H_ℓ))$, I ...
1
vote
0answers
41 views

CBC-MAC variable-length weakness with MAC size greater than the encryption block size

The title mostly explains it; CBC-MAC variable-length weakness with MAC size greater than the encryption block size I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
0
votes
0answers
31 views

Compare two protocols of keyed hash functions

Authentication protocol using a keyed hash function: Alice and Bob share a secret key for a keyed hash function. The protocol is: Alice $\Rightarrow$ $m||h_{k}(m)$ $\Rightarrow$ Bob. There are the ...
0
votes
0answers
124 views

How to forge a CBC-MAC

I'm looking for a very clear explanation of how to forge a CBC-MAC. Given M1 = m1 and M2 = m1||m2 and M3 = m1|| m2 || m3$ and their respective MACs are MAC1 MAC2 and MAC3. How would I go about forging ...
-2
votes
2answers
247 views

What are some of the real world uses of Message Authentication Code?

I have been searching but can't seem to find any proper articles that explain the real world use cases of Message Authentication Code. Can someone please shine some light on this?
2
votes
1answer
100 views

Is an HMAC based on a second-preimage resistant hash function always unforgeable?

If hash function is collision-resistant, then its associated HMAC is always unforgeable. But suppose that a hash function is only second-preimage resistant, not necessarily collision-resistant. Then ...
1
vote
1answer
151 views

is MAC double-hashing enough to prevent length extension attacks?

I know that $$mac=\operatorname{SHA1}(secret\mathbin\|message)$$ is prone to length extension attacks, but what about: $$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))?$$ In ...
0
votes
1answer
64 views

What will be the MAC size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?

What will be the mac size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC? Will it always be 128 bits MAC size for no matter how many numbers of blocks?
0
votes
1answer
448 views

blockcipher-based MACs with variable length that are UF-CMA secure?

There are may papers and notes explain why CBC-MAC is only UF-CMA secure for fix length messages. Are there any other blockcipher-based (blockcipher and hash combined included) MACs that is UF-CMA ...
0
votes
1answer
50 views

collision resistance with added permutation

Suppose we have an $n$ bit ciphertext $c$ protected by a $k$ bit $MAC$, with $k < n$. Generally, we expect collisions after $O(2^{k/2})$ ciphertext/MAC pairs are seen. Consider the following ...
3
votes
1answer
108 views

With AES encryption and a known key and plaintext, can an attacker create a different key and plaintext resulting in the same ciphertext?

In short: with AES encryption can an attacker create a new key2 and plaintext2 so that AESkey1(plaintext1) = AESkey2(plaintext2) If so, can it be solved by just applying for instance a MAC like AES-...
3
votes
1answer
236 views

Do the session keys have the same value on both sides during TLS?

I have two questions about the sessions keys generated during the last steps of the Handshake phase: Do the "client write key" and the "server write key" have the same value, even ...
0
votes
0answers
34 views

Why is MAC encrypted in TLS data transmission? [duplicate]

Referring the slide 16 from this link: I want to ask why is MAC encrypted along with the data to be transmitted. Why isn't MAC just appended at the end of encrypted data ?
2
votes
1answer
230 views

ISO 9797 MAC algorithm 3 for 7 bytes

I should implement ISO 9797 MAC algorithm 3 with initial transformation 1, without truncation, and using DES as a block cipher. I should add padding of 0x80, then ...
0
votes
0answers
38 views

Digital Signature or MAC Yielding Non-Binary Verification Predicate

Is there a digital signature or MAC scheme in which, the verification algorithm returns not $\{\text{Valid},\text{Invalid}\}$, but a discrete (finite or infinite) set of result such as $\{\text{Valid-...
1
vote
2answers
251 views

Why is a MAC verification algorithm required when we can simply create a new MAC and compare the received one with the one calculated?

The process of verifying integrity through MAC involves two separate algorithms (as mentioned here). On the server side, a signing algorithm runs which calculates ...
0
votes
1answer
78 views

Design flaws when designing a MAC-function

Suppose we want to build a very basic hash function like this: $$c_i = h(c_{i-1},x_i) = c_{i-1}\oplus x_i \quad\quad mit \;\; i\geq1, c_0 = \operatorname{IV}$$ Now suppose we'd use this hash-function ...
5
votes
3answers
243 views

What are the benefits of using AEAD algorithms as MAC

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...
1
vote
2answers
379 views

Is it fair to say that MACs use a signing algorithm?

The Wikipedia page on MAC calls the algorithm that is used to generate the MAC as a signing algorithm. Is that a fair use of that term? Can we then say that HMAC-SHA-1 uses SHA-1 as the signing ...
2
votes
1answer
101 views

Why Authenticated Encryption the same message again is not secure?

It is the Exercise 9.14 (9.1) from the book A graduate course in applied cryptography by Boneh and Shoup. Let $(E, D)$ be an AE-secure cipher. a. $E_1(k,m):=(E(k,m), E(k,m));$ $$D_1(k,(c_1,c_2)):= ...

1
2 3 4 5
10