Questions tagged [mac]
(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.
559
questions
0
votes
0
answers
29
views
Verify HMAC tag without knowing the key
Let's say there's Alice and Bob.
Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$.
Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
- 315
6
votes
1
answer
809
views
Does the order of validations and MAC with clear text matter?
I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag.
The question is whether the MAC should be validated first or if the fields are filled in ...
- 90.2k
3
votes
1
answer
145
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
CommunityBot
- 1
2
votes
1
answer
84
views
Does having more than one HMAC provide more information to the attacker?
Suppose $N$ many messages has been sent from $A$ to $B$ in this format:
$\operatorname{HMAC}(K, C(i)) \mathbin\| C(i)$.
Where
$C(i)$ is some cipher-text encrypted with some secure algorithm using ...
- 134k
2
votes
1
answer
245
views
Constructing a mac scheme secure to regular definition but insecure to special case
The mac-forge security game for mac schemes looks like this:
$k \leftarrow \operatorname{Gen}(1^n)$;
$(m,t) \leftarrow A^{\operatorname{MAC}_k(⋅)}(1^n)$;
Let $Q$ denote the set of all queries that $A$...
CommunityBot
- 1
2
votes
1
answer
100
views
Paper based OTP and MAC
Consider the following paper based OTP
Plaintext has 11 possible symbols 0-10.
$C_i = M_i + K_i\ mod\ 11$.
$K_i$ comes from a pre-shared key material which is never reused.
How to introduce data ...
- 136
0
votes
0
answers
63
views
Is my domain separation in stream cipher and MAC accepted?
I would like to implement domain separation in encryption/decryption along with MAC.
The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
- 125
0
votes
1
answer
634
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CommunityBot
- 1
1
vote
0
answers
92
views
Quantum-Safe MAC: HMAC and CMAC
If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
- 153
3
votes
2
answers
245
views
Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?
Context
I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
- 90.2k
0
votes
0
answers
22
views
MAC Generation in ZUC: why is the test data non-byte aligned?
Short question: is there a particular reason why all standardized test data for the input message for 128-EIA3 is non-byte aligned?
- 1
1
vote
0
answers
39
views
Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?
Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC
$ Tag:\{0,1\}^\lambda \...
- 33
16
votes
6
answers
6k
views
Why MACs are so important despite digital signatures doing everything a MAC can do and more?
When an entity $A$ wants to send a message to entity $B$, he can attach a MAC to the message. Entity $B$ on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
- 2,543
2
votes
1
answer
95
views
Alternative definition of security for MAC
In the usual definition of security for message authentication codes, we let an adversary $A$ have access to an oracle for $Mac_k(.)$. However, if we consider that there exists a more powerful type of ...
CommunityBot
- 1
2
votes
1
answer
290
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 90.2k
4
votes
0
answers
82
views
Practical attack on MD5(key || fixed-length-message) as MAC?
I wonder if there is any practical attack on MD5(key || fixed-length-message).
- 163
10
votes
1
answer
5k
views
Can I use a HMAC for Replay Attack protection?
I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
CommunityBot
- 1
2
votes
1
answer
358
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 90.2k
2
votes
1
answer
256
views
AES-128/CTR/NoPadding HMAC vs Signature
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
- 46k
1
vote
0
answers
81
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
16
votes
2
answers
3k
views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
- 134k
2
votes
1
answer
332
views
CPA secure to CCA secure encryption
Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
- 2,333
1
vote
1
answer
88
views
Can we achieve IND-CCA without a MAC?
In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in
2007 Authenticated Encryption: Relations among ...
- 11.2k
1
vote
0
answers
77
views
Trying to understand this Solution related to CCA security
4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
- 19.9k
1
vote
1
answer
72
views
Symmetric MAC benefit
I have a question about symmetric message authentication codes (MACs).
Say Bob sends encrypted messages to Alice using a symmetric cipher. As I understand it:
(1) Their threat model could or should ...
- 134k
9
votes
1
answer
1k
views
Which MAC scheme is quantum resistant?
Will HMAC resist Grover's algorithm? If not, which MAC scheme will provide post-quantum security?
- 14.9k
8
votes
1
answer
613
views
Is constant-time compare really required for AEAD ciphers?
When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
- 36k
8
votes
3
answers
989
views
Is there a companion algorithm for OTP to ensure integrity and/or authentication?
One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved:
Fast generation of independent and identically distributed random variables
Perfect key ...
- 11
3
votes
1
answer
141
views
What is the purpose of the WireGuard handshake mac1 field?
The mac1 field in the WireGuard handshake messages is populated as:
...
1
vote
2
answers
141
views
How to compose multiple values to MAC authenticate?
If the data I want to authenticate consists of multiple values and I compute a MAC simply concatenating the values, an adversary can "shift" characters within those values without ...
- 2,665
1
vote
1
answer
194
views
How to know that MAC isn't modified in ECIES
I am new to ECC but I was wondering,
If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
- 8,263
-1
votes
1
answer
84
views
Hash Function Vs Signature Vs MAC?
I read: What are the differences between a digital signature, a MAC and a hash?
and Found this amazing answer: https://crypto.stackexchange.com/a/5647
But one question remains:
I know that for huge ...
- 90.2k
1
vote
1
answer
592
views
Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?
Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes,
And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
- 134k
1
vote
1
answer
61
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 90.2k
1
vote
1
answer
92
views
Authentication tag length and post-quantum security
The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
- 19.9k
-1
votes
1
answer
82
views
Simplification: Should we MAC-then-encrypt or encrypt-then-MAC?
I refer to Should we MAC-then-encrypt or encrypt-then-MAC?.
There are 15 answers (today) with many words. It is difficult to tell which is the correct(?) answer. Also, the question excludes the ...
1
vote
2
answers
153
views
What is more efficient to Encrypt then MAC or to MAC then encrypt
I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
0
votes
1
answer
70
views
Short description of encryption methods? [closed]
I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them.
Hash then encrypt
MAC then encrypt
Encrypt and MAC
Encrypt then MAC
3
votes
1
answer
2k
views
Composition of X25519+XSalsa20+Poly1305
In a correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
- 141
0
votes
1
answer
79
views
Hybrid Authentications
Is there a reason why we can't combine private key MAC with digital signature to get a hybrid authentication scheme?
Is it because of the computational assumptions that digital signatures have?
Edit: (...
CommunityBot
- 1
0
votes
1
answer
102
views
Why is a weakly secure MAC without verification queries not necessarily weakly secure in the presence of verification queries?
I'm self-studying cryptography from A Graduate Course in Applied Cryptography by Boneh and Shoup (version 0.5), and I'm having trouble seeing the result in Exercise 6.7.
In the book a secure MAC ...
- 1
1
vote
0
answers
126
views
CBC MAC forgery [duplicate]
$\text{CBC-MAC}$ is defined as follows:
$\text{CBC-MAC}_k() = IV $
$\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$
My lecture notes say that this is ...
- 8,263
1
vote
0
answers
69
views
Can you use Output Feedback Mode (OFB) to construct a Message Authentication Code (MAC)
Suppose $f_k$ is an arbitrary block cipher. Can OFB via $f_k$ be used to make a MAC. I argue that you can't even with fixed l, $m = l \times k$ because in OFB, $\mu = f_k(f_k(...((IV))) \oplus m$, and ...
- 41
1
vote
1
answer
99
views
MAC vs MDC when using ECDH+ECDSA in OpenPGP
I intend to design a model to comply with RFC4880.
According to RFC6637, ECC in OpenPGP
+ECDSA to sign message
+ECDH + KeyWrap for session key encryption
-MAC: is used for key confirmation (with C(1e, ...
- 6,005
0
votes
0
answers
29
views
Has reducing MAC size and increasing message size the same effect on security?
I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
- 101
1
vote
0
answers
119
views
Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?
The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
- 111
3
votes
1
answer
5k
views
HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC
I'm looking at three options for shared-secret message authentication codes:
HMAC-SHA-256(secret, payload)
SHA-512/256(secret+payload)
SHA-512(secret+payload) truncated to 256 bits
Option 1 is the ...
- 14.9k
414
votes
13
answers
177k
views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
- 5
1
vote
1
answer
169
views
Using Chaskey as a stream cipher
Chaskey (https://eprint.iacr.org/2014/386.pdf) is a a secure, compact and efficient MAC for embedded systems and has won many benchmarks. It is built using an Even-Mansour block cipher. This block ...
- 46k
2
votes
1
answer
1k
views
Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?
TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM.
The TLS Cipher Suite Registry contains no cipher suites that use ...
- 46k