Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

1
vote
1answer
47 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
0
votes
0answers
28 views

problem in my tls1.2 implementation [closed]

so I'm writing my own tls 1.2 implementation for learning's sake and because the server I'm connecting to use a modified version of the protocol that ask for a non random client_random anyway (TL;DR: ...
1
vote
1answer
77 views

Hash for use in embedded HMAC application

I developed a GNSS logger (http://flysight.ca) which has become popular for scoring skydiving competitions. At the moment, there is little protection against competitors falsifying tracks, but I would ...
1
vote
0answers
61 views

A modification of the NMAC construction

Consider the NMAC construction: This is a proposed exercise in my notes: Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$? In ...
-1
votes
1answer
40 views

Length extension attack for file download

I am trying to understand the length extension attack. I found this tutorial where the author performs length extension on a file download URL. Original URL: http://example.com/download?file=...
3
votes
0answers
52 views

1-digit MAC with error-catching properties?

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
4
votes
2answers
104 views

Why is this MAC flawed?

Consider a function to create a tamperproof cookie as follows: $$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$ where $m$ is a message provided by Alice, and k is a secret key known only to ...
4
votes
1answer
82 views

Difficulty of forging MACs based on linear functions over $GF\left(2^n\right)$

This is a homework question, therefore I'm not expecting full solutions, just general guidance. I want to build a one-time MAC using universal hashing. I defined my hash functions as: $h_{a,b}:\...
0
votes
1answer
44 views

Two-way secret sharing for authentication?

Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ...
1
vote
1answer
72 views

Is this MAC correct and secure?

Let $m \in \{0, 1\}^{2n} = m_1 || m_2$. Let's also assume that $F_k$ is a PRF and $G$ is a PRG defined as $G: \{0, 1\}^n \rightarrow \{0, 1\}^n$. Now, Let's define the $MAC$ scheme as follows: $$MAC(...
1
vote
1answer
76 views

Is the scheme $(r, Mac_k(r) \oplus m)$ CPA-secure?

I honestly admit this question is taken from a h.w assignment: Prove or refute: the following encryption scheme is CPA-secure: Let $(\text{Gen}, \text{Mac}, \text{Vrfy})$ be a secure MAC with tags ...
4
votes
1answer
92 views

Are there any non Canonical Verifiable Cryptographic MACs

In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs; Canonical verification. For deterministic message authentication codes (that is, ...
4
votes
1answer
263 views

ISO 9797-1 MAC Algorithm 3 and Doc 9303-11 [closed]

I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 ...
0
votes
1answer
109 views

Show that if a fixed key MAC is not collision resistant then the MAC function is not computation resistant for every key K

I'm really having some trouble with this one. Let $H$ be a MAC function. For every key $K$ we can create an unkeyed hash function (i.e.an MDC) by using $H$ to hash messages with the fixed key $K$. ...
5
votes
2answers
239 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
0
votes
1answer
45 views

Can a Message Authenticaty Code recover original data from corrupted data?

I am new to cryptography and have been studying for Dan Boneh's Stanford Course on Coursera, after going through encrytpion and decryption I've started the integrity portion of the Course. Sir ...
2
votes
1answer
136 views

Is Strong MAC stronger than existential unforgeability?

Especially in the context of Encrypt-then-Authenticate.
1
vote
2answers
91 views

AES blocks with a counter

I would like to send small separate packets of data. I am thinking of using AES-128 or AES-256, and to add a counter as part of the plain text message. Some clarifications: Each message will be one ...
19
votes
1answer
3k views

Why is SHA-3 robust against Length-Extension Attacks?

If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?
2
votes
1answer
46 views

Why does bit padding work in practice in a message authentication code?

I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded. What I don't ...
1
vote
1answer
45 views

MAC and signatures

A message accompanied with a digital signature and a MAC. are there any possibility to know that the digital signature and the MAC are generated from the same message?
2
votes
1answer
86 views

AES ECB mode for both encryption and authentication

Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true? Encryption of exactly 128-bit (1 block) size messages Different keys used for both ...
1
vote
1answer
107 views

What cryptography primitives can help me (generate unforgeable tag)?

I have a read-only public bulletin board that It contains a series of information to form: $$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$ where $a_i\in\{0,1\}^...
2
votes
1answer
116 views

Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows: ...
1
vote
0answers
40 views

Parallel MAC vs doubled rounds for SipHash, KMAC and others

SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option. I was wondering from a security perspective how this would compare ...
0
votes
1answer
83 views

Challenging Question for the Build a Secure MAC with Special Properties

We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable. [Note that unsuccessful attempts to build such a scheme ...
-1
votes
1answer
73 views

Is this construction a secure MAC?

Let $F:\{ 0,1 \}^n \times \{ 0,1 \}^ n \rightarrow Z^*_q $ is a PRF, and $H:\{ 0,1 \}^{2n} \rightarrow \{ 0,1\}^n$ is a secure hash function. Is the following construction $\Pi=(Gen,Mac,Vrfy)$ is a ...
1
vote
3answers
569 views

Understanding MACs and why cleartext is sent over

Assume both Alice and Bob have a symmetrical key, let's call it $k$. They agree on a cryptographic hash function, let's call it $\mathsf{HASH}$. Now Alice wants to send an authenticated message. She ...
1
vote
2answers
246 views

Relationship between PRF/KDF/MAC?

It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
3
votes
1answer
130 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
0
votes
1answer
452 views

AES CBC MAC Generation

I am working with Atmel's/MicroChip's ATAES132A 32K AES Serial EEPROM chip for hardware encryption and decryption. This is my first venture into cryptography. I've been reading through the datasheet ...
3
votes
1answer
1k views

HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

I'm looking at three options for shared-secret message authentication codes: HMAC-SHA-256(secret, payload) SHA-512/256(secret+payload) SHA-512(secret+payload) truncated to 256 bits Option 1 is the ...
0
votes
1answer
45 views

What is the difference between verifying the hash value (MAC) and security provided by authenticated encryption?

I read this post Difference between MAC and Authenticated Encryption? but I'm still confusing the difference. Seems like MAC can guarantee both integrity and authenticity (tbh I dont know the ...
3
votes
3answers
222 views

Secure MAC and secure encryption schemes combined to form insecure Authenticated Encryption?

I'm reading up on Authenticated Encryption and can't really wrap my head around how a generally secure MAC and a generally secure encryption scheme can be combined into an insecure AE scheme, such as ...
5
votes
2answers
288 views

Proof that MAC and hash composition is insecure

Let $F$ be a secure PRF and $H$ a universal hash function. How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$ is an insecure MAC (or an insecure PRF, since a ...
2
votes
1answer
155 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
0
votes
1answer
117 views

Proof that MAC is insecure

I've just started studying MACs and I faced the following challenge: Let $F$ be a PRF over $(\mathcal{K,R,X})$ where $\mathcal{X} = \{0,1\}^{32}$ Let $\mathrm{CRC32}(m)$ be a function that takes ...
1
vote
1answer
49 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
1
vote
2answers
101 views

MAC attacks without knowing the key

Attacks on a MAC that do not require the discovery of the key are possible. Consider the following MAC algorithm. Let $M=(X_1\mathbin\|\dots\mathbin\|X_m)$ be a message that is treated as a ...
0
votes
1answer
53 views

Distinct MAC and Key for AEAD?

I am implementing some of the algorithms in RFC 7518 and I noticed that AES_CBC_HMAC_SHA2 contains the following paragraph: The secondary keys MAC_KEY and ENC_KEY are generated from the ...
0
votes
1answer
72 views

First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block. i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$ My question is,...
2
votes
1answer
98 views

Which one is better using DSA, or MAC and encryption?

I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA. by using MAC, I required a shared key between ...
1
vote
0answers
63 views

PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...
3
votes
1answer
88 views

MAC size: Should MAC be shorter than cipher block size?

Many sources claim that (if possible) a length of MAC should be as long as possible. So it should have the same size as size of the block of used cipher. However there is the following note in Bouncy ...
0
votes
1answer
371 views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
1
vote
1answer
291 views

Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
5
votes
1answer
323 views

Recommended key lengths for BLAKE2b

RFC 7693 provides the following table of standard parameter sets for BLAKE2b without a key (where nn is the hash size in bytes): ...
4
votes
1answer
520 views

Can keyed CRC be used as a MAC?

Consider a "MAC" that uses a symmetric key $K$ to generate an authentication tag $t$ for a message $M$ in the following way: Concatenate a timestamp with the message (to prevent replay attacks) $$ m =...
1
vote
0answers
45 views

MAC with key supplied afterwards

Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
1
vote
1answer
115 views

Is MAC required with Sign-then-Encrypt?

Consider a scenario where a message is sent encrypted and signed using public-key cryptography. When using asymmetric encryption, you end up also using symmetric encryption if the message is large (...