Questions tagged [mac]
(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.
127
questions
414
votes
13
answers
177k
views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
- 86.1k
60
votes
2
answers
18k
views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
- 703
37
votes
4
answers
9k
views
Why is plain-hash-then-encrypt not a secure MAC?
It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why?
Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
- 1,101
25
votes
4
answers
5k
views
Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
- 134k
237
votes
2
answers
133k
views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
- 2,668
20
votes
2
answers
3k
views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = \mathrm{hash}(k||\mathrm{data})$...
Daniel
26
votes
2
answers
6k
views
Is HMAC needed for a SHA-3 based MAC?
HMAC does nested hashing in order to prevent Length Extension Attacks.
Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
- 499
17
votes
2
answers
7k
views
Why is h(m||k) insecure?
Here is the post that explains the failure for doing h(k||m) and I understand it.
But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain?
- 333
13
votes
1
answer
2k
views
Why does HMAC use two different keys?
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?
See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
- 429
6
votes
2
answers
1k
views
Proof that MAC and hash composition is insecure
Let $F$ be a secure PRF and $H$ a universal hash function.
How can I exhibit a pair $(F,H)$ whose composition $$S'((k_1, k_2), m) = F(k_2, H(k_1,m))$$
is an insecure MAC (or an insecure PRF, since a ...
- 437
19
votes
2
answers
2k
views
Can I use HMAC-SHA1 in counter mode to make a stream cipher?
Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey).
Would it be secure to feed it like a block cipher in counter mode to get a ...
- 538
24
votes
2
answers
5k
views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mathbin\| x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k \...
22
votes
2
answers
19k
views
What is the purpose of four different secrets shared by client and server in SSL/TLS?
I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including
client write mac secret,
server write mac secret,
server write key,
client ...
- 1,883
9
votes
2
answers
1k
views
Why have hashes when you have MACs?
It would seem to a naive eye that if you have a MAC, you have a hash function: use a key that all the parties know (such as all-bits-zero).
A potential application would be a resource-constrained ...
5
votes
1
answer
10k
views
Insecurity of CBC-MAC
Can anyone explain why CBC-MAC is not secure for variable length message?
I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures
Questions:
why ...
- 133
39
votes
2
answers
30k
views
AES-GCM recommended IV size: Why 12 bytes?
When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.
Let's assume a ...
- 493
24
votes
2
answers
3k
views
Definition of "pepper" in hash functions
I am confused about the notion of "pepper" in the context of storing hashes of users' passwords.
Definition 1: A pepper is a secret key
Looking around the Internet, for example here or here, ...
- 535
13
votes
2
answers
2k
views
How is HMAC(message,key) more secure than Hash(key1+message+key2)
I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction.
What I don't understand is, how or why is $\...
- 1,397
11
votes
4
answers
7k
views
What is the advantage of digital signatures over message authentication codes?
Studying for CISSP these choices seemed limited:
What is the advantage of digital signatures over message authentication codes?
Digital Signature provides integrity verification while ...
- 119
9
votes
2
answers
5k
views
How is digital signature different from a message authentication code (MAC)?
I know the definitions of both but can't specifically tell how they are different and if one is better than the other.
Please help.
- 93
9
votes
2
answers
2k
views
Keys in HMAC and NMAC
I'm quite new to this topic and have several questions concerning HMAC and NMAC:
Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
- 193
8
votes
3
answers
989
views
Is there a companion algorithm for OTP to ensure integrity and/or authentication?
One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved:
Fast generation of independent and identically distributed random variables
Perfect key ...
- 5,289
56
votes
2
answers
67k
views
What is the difference between MAC and HMAC?
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
40
votes
4
answers
5k
views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
- 24.6k
42
votes
1
answer
43k
views
Ciphertext and tag size and IV transmission with AES in GCM mode
I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
- 1,365
12
votes
1
answer
3k
views
For a one-time pad, which MAC method is information-theoretically secure?
In the the main post about MAC methods it mentions a few methods:
Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
- 368
5
votes
2
answers
2k
views
Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?
Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
- 441
14
votes
2
answers
2k
views
Can any MAC be used as a KDF?
First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
- 243
11
votes
3
answers
2k
views
Is Poly1305 an information-theoretically secure MAC?
I have heard some people say that the Poly1305 authenticator is a "nuclear" MAC i.e. it is information-theoretically secure. After reading the paper I see it is based on the Wegman-Carter MAC which is ...
- 368
9
votes
1
answer
2k
views
Practical uses of Manipulation Detection Code (MDC) and IGE
I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:
We show that generic compositions of confidentiality-...
- 90.2k
9
votes
1
answer
1k
views
Which MAC scheme is quantum resistant?
Will HMAC resist Grover's algorithm? If not, which MAC scheme will provide post-quantum security?
- 93
7
votes
1
answer
3k
views
Has GMAC mode a future outside GCM?
Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
- 653
2
votes
2
answers
681
views
Difference between MAC and Authenticated Encryption?
I am currently studying authenticated encryption and I was wondering if there was a difference between using a MAC and authenticated encryption. It seemed like authenticated encryption schemes use ...
- 269
1
vote
2
answers
2k
views
Deriving HMAC key and cipher key from passphrase? [duplicate]
I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
- 947
28
votes
2
answers
25k
views
HMAC vs MAC functions
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.
What are principle differences?
When to use one and when the other?(Typical Use Cases)
- 1,131
23
votes
3
answers
3k
views
Why is Poly1305 popular given its 'sudden death' properties?
ECDSA has the undesirable property that if a key pair reuses a nonce in a signing operation, the cryptosystem experiences catastrophic failure in the form of private key leakage. I've heard this ...
- 333
18
votes
1
answer
3k
views
Cryptographically secure keyed rolling hash function
I could not find any mention on the Internet of a proven/known cryptographically secure keyed rolling hash function (ie rolling MAC). Has the question been studied, is it possible to build one ?
By ...
- 350
17
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
- 271
13
votes
1
answer
5k
views
Why do we encrypt-then mac but sign-then-encrypt?
This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so:
The general advice for applying ...
user46
12
votes
2
answers
2k
views
Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?
I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and ...
- 223
11
votes
1
answer
516
views
Can Skein be used as a secure MAC in format H(k || m)?
Can Skein be used as a secure MAC in format H(k || m)?
I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
- 145
10
votes
1
answer
349
views
How would you encrypt-then-MAC when using pen-and-paper and a Caesar cipher?
I'll probably get shot for asking this, but I've got some kids (aged 8-10) in my neighbourhood that I've been showing/teaching the simple pen-and-paper Caesar cipher and they're successfully playing ...
- 17.7k
10
votes
1
answer
5k
views
Can I use a HMAC for Replay Attack protection?
I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
- 195
8
votes
2
answers
2k
views
Is the HMAC construction really neccessary for a fixed length message?
The HMAC Construction is defined as:
Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) )
This was designed because a simpler construction such as:
...
- 341
7
votes
3
answers
1k
views
Why is a MAC needed with CBC?
I agree that for certain encryption systems or modes of operation, a MAC is indispensible.
The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
- 1,778
7
votes
4
answers
3k
views
The difference between MACs vs. HMACs vs. PRFs
I have some confusion regarding the difference between MACs and HMACs and PRFs and when to use which term.
If the function is computed using a hash and secret key like the following, is this a HMAC ...
- 503
6
votes
1
answer
517
views
Are there any non Canonical Verifiable Cryptographic MACs
In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs;
Canonical verification. For deterministic message authentication codes
(that is, ...
- 46k
6
votes
1
answer
593
views
Non-cryptographic hash function as MAC for stream ciphers
I understand that for a stream cipher to be useful, there must be a way to verify that the message was not tampered with (bits were flipped by an attacker).
So, instead of using some cryptographic ...
- 277
4
votes
1
answer
2k
views
Can keyed CRC be used as a MAC?
Consider a "MAC" that uses a symmetric key $K$ to generate an authentication tag $t$ for a message $M$ in the following way:
Concatenate a timestamp with the message (to prevent replay attacks)
$$
m =...
- 143
4
votes
1
answer
1k
views
chacha20-poly1305 padding and length encoding
The AEAD construction for chacha20-poly1305 described in the IETF proposal encodes message lengths into the text that is to be hashed. The newer proposal goes further and pads associated data and ...
- 143