Skip to main content

Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
0 votes
0 answers
28 views

Is the CFB mode of Encryption related-key secure

I am going through the paper https://www.iacr.org/archive/fse2013/84240283/84240283.pdf where the related key security of CBC mode of encryption is well analyzed. I am concerned about whether the CFB ...
3 votes
2 answers
123 views

How can a attacker find a collision of a keyed digest without knowing the key? Are collisions not an issue anymore if we apply a keyed-digest?

Same as the title. How can an attacker find a collision in a keyed digest without knowing the key? Does using a keyed digest eliminate the problem of collisions?
0 votes
0 answers
29 views

Shared taxonomy for hash, mac and digital signature algorithms and output?

I'm creating a cryptography API, and because naming things is hard, I'm trying to define a common name that identifies functions that accept input of arbitrary length and produce either digital ...
2 votes
1 answer
87 views

Linear Message Authentication Codes

I am studying the message authentication codes introduced in this paper. These MACs are linear in the sense that, if $f(m,k)$ denotes the tag appended to the message $m$ when the agreed upon key is $k$...
247 votes
2 answers
144k views

What are the differences between a digital signature, a MAC and a hash?

A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind. Which assurances does each primitive provide to the recipient? What kind of keys are needed?
2 votes
1 answer
132 views

Is it safe to "sign" a message with such a zk proof

I am building an application in which I need to sign a message without revealing my entire identity. To do so, I just compute a zk proof with the following purpose: prove I own the secret key sk ...
3 votes
1 answer
112 views

Understanding CBC-MAC Algorithm and Nested Encryption

In the CBC-MAC algorithm as given in the image below, I have two questions: It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, ...
424 votes
13 answers
192k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
3 votes
1 answer
262 views

Security of using key size larger than the message digest size in HMAC, with one time pads

I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption. One time pads for the message and the key of HMAC are ...
1 vote
2 answers
94 views

MAC question i got in a test, would like your opinion on my answer

Given a MAC secure scheme $(\text{Gen}, \text{Mac}, \text{Vrfy})$, a new scheme is suggested: $\text{Gen}' \rightarrow \text{Gen} = (pk_1, sk_1), \text{Gen} = (pk_2,sk_2)$ $\text{Mac}'(m) = (\text{...
2 votes
1 answer
136 views

How do I generate a sequence of numbers with unpredictable differences

This question relates to bit flip attacks on OTP encrypted messages. Lets say I've got a list of numbers from 0 to 2^24-1 I want to re-order the list so it has the following property: If you start at ...
0 votes
0 answers
20 views

Reduction For MAC systems

I am not too knowledgeable regarding reductions for message authentication code encryption. Here is an example I found: There is a MAC' based on a preliminary existing MAC as such: MAC'(k, m) = MAC(k,...
13 votes
1 answer
5k views

Why do we encrypt-then-mac but sign-then-encrypt?

This question was asked in comments on my answer to Should we MAC-then-encrypt or encrypt-then-MAC? I think posing the question as a separate entity is best, so: The general advice for applying MACs ...
0 votes
1 answer
81 views

Simplified MAC Algorithm

I would like to come up with a MAC algorithm that is simple and provably secure. The message and mac are OTP encrypted. For the purpose of this exercise lets say the entire plaintext is known to the ...
0 votes
0 answers
82 views

What is the simplest method of protecting a one time pad encrypted message from bit flip attacks?

I'm building a micro-controller based encryption device that uses one time pads. System details The reason I'm going this route is that I want a system which secure, but also very simple and easy to ...
0 votes
3 answers
87 views

Is it possible to construct a (pseudo-)continuous PRF or MAC?

Is it possible to construct an efficient-to-compute function $F: X \rightarrow Y$ such that Given samples $(x_1, F(x_1))...(x_n, F(x_n))$, any efficient adversary ($F$ itself is kept secret) can't ...
6 votes
2 answers
540 views

Message Authentication Code Padding Overview

I am confused about padding when using a Message Authentication Code (MAC). This paper suggests using a different key if the message is padded, and otherwise not, which really confused me. An example ...
0 votes
0 answers
143 views

Known message attack on ENC-MAC with AES encryption

The assignment I have is as follows: Let $l=2^{128}$ and let $x$ be a random integer satisfying $0\le x \le l$ Let $\oplus $ be the XOR operator and $E_k$ an AES encryption with $key=k$ Let the ...
3 votes
1 answer
186 views

Carter-Wegman MAC different notations

While studying Carter-Wegman message authentication codes MAC, I got two different notations for the broader concept and have problems with understanding the difference, if any exist. Let $K, K_1, K_2$...
4 votes
1 answer
140 views

Does the length extension attack apply to KDFs?

Older hash functions like SHA-256 and SHA-512 are vulnerable to the length extension attack, which is problematic in the context of a MAC. There are several ways to prevent this: Use a newer hash ...
1 vote
1 answer
81 views

Security of this MAC scheme

I'm studying for a cryptography exam, I have this question from a past exam: Consider the MAC with key $k$, based on a block cipher $E_{(k)}$ with block size $n$, and a collision-resistant hash ...
0 votes
0 answers
77 views

Possible MAC design

The problem Let the following be a family of PRF functions with key length $2\lambda$ $$\mathbb{F} = \{F_k:\{0,1\}^n\rightarrow\{0,1\}^n\}_{k\in\{0,1\}^{2\lambda}}$$ Assuming one way functions exists, ...
0 votes
1 answer
54 views

Long term Stream Cipher cipher text with MAC storage

Let's say I have x bytes of data that needs to be encrypted with Stream Ciphers such as AES256-CTR, ChaCha20, Salsa20, XChaCha20, XSalsa20. I would like to ask, since these ciphers typically requires ...
0 votes
2 answers
70 views

Can the secret and the message be switched in a mac? [duplicate]

A HMAC is usually said to be H(sk || msg) for some secret key sk and message msg. My first question is, can we compute it as H(msg || sk) instead ? Is there any drawbacks doing it ? If the answer is ...
1 vote
0 answers
45 views

Short-input (<= 128 bit), short-output (<= 10 bit) MAC

I am faced with a problem of selecting an appropriate message authentication code (MAC) for a particular application. These are the constraints: I have two 64-bit integers $r_a$ and $r_s$ as input, ...
4 votes
0 answers
85 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
3 votes
2 answers
2k views

Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...
0 votes
0 answers
48 views

Using AEAD as pure MAC with *only* associated data? [duplicate]

Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
1 vote
1 answer
60 views

Can MCOE AEAD mode be modified to work with Threefish tweak block cipher and generate intermediate tags

The MCOE mode provides a really nice way to implement a nonce-misuse resistant AEAD and is based on an arbitrary tweak block cipher. A specific requirement of the tweak block cipher is that the data ...
1 vote
2 answers
141 views

MAC from PRF secure under different restriction

Suppose, we have a secure PRF $F$. Then can there be a MAC Scheme $I=(Sign, Verify)$ using F such that $I$ is insecure, but I is secure under the restriction that all the queries for MAC challenges ...
2 votes
2 answers
181 views

A question about "attacks on MAC key space"

At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
0 votes
0 answers
46 views

Parallelizable MAC/hash value stored securely

Assume the following: $E: \{0, 1\}^k \times \{0, 1\}^b \rightarrow \{0, 1\}^b$ is a block cipher with a $k$-bit key size and a $b$-bit block size. $T$ is a $b$-bit authentication tag that is ...
2 votes
1 answer
1k views

HMAC SHA256 walkthrough examples

I'm trying to implement HMAC SHA256 (I've implemented SHA256 successfully). I am trying to find examples where they show the results after each HMAC stage (XOR, append, H etc). Does anyone know of any ...
1 vote
1 answer
71 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
3 votes
1 answer
219 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
3 votes
1 answer
144 views

Verify HMAC tag without knowing the key

Let's say there's Alice and Bob. Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$. Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
6 votes
1 answer
820 views

Does the order of validations and MAC with clear text matter?

I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag. The question is whether the MAC should be validated first or if the fields are filled in ...
2 votes
1 answer
121 views

Does having more than one HMAC provide more information to the attacker?

Suppose $N$ many messages has been sent from $A$ to $B$ in this format: $\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$. Where $C(i)$ is some cipher-text encrypted with some secure algorithm using ...
2 votes
1 answer
292 views

Constructing a mac scheme secure to regular definition but insecure to special case

The mac-forge security game for mac schemes looks like this: $k \leftarrow \operatorname{Gen}(1^n)$; $(m,t) \leftarrow A^{\operatorname{MAC}_k(⋅)}(1^n)$; Let $Q$ denote the set of all queries that $A$...
2 votes
1 answer
120 views

Paper based OTP and MAC

Consider the following paper based OTP Plaintext has 11 possible symbols 0-10. $C_i = M_i + K_i\ mod\ 11$. $K_i$ comes from a pre-shared key material which is never reused. How to introduce data ...
0 votes
0 answers
81 views

Is my domain separation in stream cipher and MAC accepted?

I would like to implement domain separation in encryption/decryption along with MAC. The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
0 votes
1 answer
1k views

CBC-MAC Forge Attack Question

I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
1 vote
0 answers
187 views

Quantum-Safe MAC: HMAC and CMAC

If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
3 votes
2 answers
620 views

Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?

Context I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
1 vote
0 answers
70 views

Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?

Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC $ Tag:\{0,1\}^\lambda \...
16 votes
6 answers
6k views

Why MACs are so important despite digital signatures doing everything a MAC can do and more?

When an entity $A$ wants to send a message to entity $B$, he can attach a MAC to the message. Entity $B$ on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
2 votes
1 answer
102 views

Alternative definition of security for MAC

In the usual definition of security for message authentication codes, we let an adversary $A$ have access to an oracle for $Mac_k(.)$. However, if we consider that there exists a more powerful type of ...
2 votes
1 answer
1k views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
4 votes
0 answers
98 views

Practical attack on MD5(key || fixed-length-message) as MAC?

I wonder if there is any practical attack on MD5(key || fixed-length-message).
10 votes
1 answer
5k views

Can I use a HMAC for Replay Attack protection?

I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...

1
2 3 4 5
12