Skip to main content

Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

71 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
184 views

Why reveal MAC keys after using them?

As far as my understanding goes, MACs are used to determine whether the received message comes from a source with access to a MAC-key, which both parties know. Some crypto protocols reveal their used ...
Spyro's user avatar
  • 131
4 votes
0 answers
85 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
Nicole Foster's user avatar
4 votes
0 answers
98 views

Practical attack on MD5(key || fixed-length-message) as MAC?

I wonder if there is any practical attack on MD5(key || fixed-length-message).
edo1's user avatar
  • 163
4 votes
0 answers
310 views

is a MAC defined by a pseudo random generator secure?

Let $ G:\{0,1\}^*\rightarrow\{0,1\}^*$ be a length doubling PRG, and let $ \Pi=(Gen,Mac,Vrfy)$ be the following MAC scheme: $ Gen $ on input $ 1^n$ uniformly samples and outputs $ k\leftarrow \{0,1\...
creepto's user avatar
  • 49
4 votes
0 answers
111 views

Which compression functions are MACs?

The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed). How does this relate to common assumptions for ...
Elias's user avatar
  • 4,923
4 votes
0 answers
692 views

uf-cma and uf-cmva probabilistic MAC

Is there any simple probabilistic MAC $\Pi=(\operatorname{Gen},\operatorname{Tag},\operatorname{Vrfy})$ with UF-CMA security but without UF-CMVA security? How can an attacker efficiently use the $\...
Paula Ringelhahn's user avatar
4 votes
0 answers
892 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
sayantankhan's user avatar
4 votes
0 answers
195 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
tryagain's user avatar
3 votes
1 answer
263 views

Security of using key size larger than the message digest size in HMAC, with one time pads

I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption. One time pads for the message and the key of HMAC are ...
CuriousCrypto's user avatar
3 votes
0 answers
377 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
Bastian's user avatar
  • 31
3 votes
0 answers
300 views

What is the original paper of the length extension attack on hash based MAC functions

A message authentication code (MAC) based on using a hash function with the secret prefix $H(k||m)$ technique goes back to two independent sources according to Tsudik's article on 1992; S. Crocker, S....
kelalaka's user avatar
  • 49k
3 votes
0 answers
94 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
Z.T.'s user avatar
  • 824
3 votes
0 answers
59 views

1-digit MAC with error-catching properties?

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
fgrieu's user avatar
  • 142k
3 votes
0 answers
190 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
Lukas Schüßler's user avatar
2 votes
1 answer
132 views

Is it safe to "sign" a message with such a zk proof

I am building an application in which I need to sign a message without revealing my entire identity. To do so, I just compute a zk proof with the following purpose: prove I own the secret key sk ...
Makubu's user avatar
  • 21
2 votes
0 answers
68 views

Designated verifier signature from Diffie–Hellman and a MAC

Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
kirelagin's user avatar
  • 206
2 votes
0 answers
320 views

Is the following derived MAC where the output is XOR'ed with the key secure?

Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck . More details: It's just any reduction ...
Doron Bruder's user avatar
2 votes
0 answers
52 views

Attackability of one-time MAC when using block mode

Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially....
Bernd Strehl's user avatar
2 votes
0 answers
145 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
zma's user avatar
  • 43
2 votes
0 answers
119 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
user70055's user avatar
2 votes
0 answers
190 views

Using NIST constructions based on Keccak like cSHAKE128 for other sponges

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC. All this schemes come with a security guarantee and are ...
mat's user avatar
  • 2,528
2 votes
0 answers
224 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute (L·...
user24730's user avatar
2 votes
0 answers
517 views

Which of these is a secure MAC?

Let (S,V) be a secure MAC defined over $(K,M,T)$ where $M = \{0,1\}^n$ and $T =\{0,1\}^{128}$. Which of the following is a secure MAC: $S'(k,m) = S(k,m)[0,\ldots,126]\quad and \quad V'(k,m,t) = \big[...
KrasivaM's user avatar
1 vote
0 answers
46 views

Short-input (<= 128 bit), short-output (<= 10 bit) MAC

I am faced with a problem of selecting an appropriate message authentication code (MAC) for a particular application. These are the constraints: I have two 64-bit integers $r_a$ and $r_s$ as input, ...
asnfkjsdx's user avatar
1 vote
0 answers
189 views

Quantum-Safe MAC: HMAC and CMAC

If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
bilaljo's user avatar
  • 163
1 vote
0 answers
70 views

Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?

Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC $ Tag:\{0,1\}^\lambda \...
Giusy's user avatar
  • 33
1 vote
0 answers
155 views

AES-CBC-MAC forgery attack

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
MSCHA's user avatar
  • 11
1 vote
0 answers
174 views

Trying to understand this Solution related to CCA security

4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
Carlos73's user avatar
1 vote
0 answers
84 views

Can you use Output Feedback Mode (OFB) to construct a Message Authentication Code (MAC)

Suppose $f_k$ is an arbitrary block cipher. Can OFB via $f_k$ be used to make a MAC. I argue that you can't even with fixed l, $m = l \times k$ because in OFB, $\mu = f_k(f_k(...((IV))) \oplus m$, and ...
amlearn369's user avatar
1 vote
0 answers
139 views

Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?

The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
DodoDude700's user avatar
1 vote
0 answers
136 views

Proof check: Forgery for a MAC

I'm looking at the MAC defined as follows: $$\text{Mac}_k(m)=\langle r,f_k(r\oplus m)\rangle $$ where $r$ is uniformly chosen at random (each time) and $f_k$ is a PRF. Vrfy is the canonical one. I'm ...
yankovs's user avatar
  • 21
1 vote
0 answers
232 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
Sayantan's user avatar
1 vote
0 answers
111 views

Insecure pseudo random functions

Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key): $(a)$ To authenticate a ...
Sayantan's user avatar
1 vote
0 answers
324 views

CBC-MAC variable-length weakness with MAC size greater than the encryption block size

The title mostly explains it; CBC-MAC variable-length weakness with MAC size greater than the encryption block size I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
Ben's user avatar
  • 11
1 vote
0 answers
99 views

Implementing MAC with PRF family $f$, why do we need $f_k$ to be invertible?

As per the title, say we have $\text{MAC}(k,m) = (m,f_k(m))$ where $f$ is a PRF family and every function $f_k$ is PRP, where $f_k(m)$ and $f_k^{-1}(m)$ are efficiently computable. I proved that this ...
user574362's user avatar
1 vote
0 answers
153 views

Circular Security - Encrypting the key with the key

I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
bobuhito's user avatar
  • 315
1 vote
0 answers
119 views

Generating a MAC on a Polynomial

In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
Aydin's user avatar
  • 442
1 vote
0 answers
100 views

A modification of the NMAC construction

Consider the NMAC construction: This is a proposed exercise in my notes: Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$? In ...
user1868607's user avatar
  • 1,243
1 vote
0 answers
82 views

Parallel MAC vs doubled rounds for SipHash, KMAC and others

SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option. I was wondering from a security perspective how this would compare ...
MotiNK's user avatar
  • 324
1 vote
0 answers
146 views

PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...
xxmaxx's user avatar
  • 11
1 vote
0 answers
53 views

MAC with key supplied afterwards

Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
Maarten Bodewes's user avatar
  • 93.3k
1 vote
0 answers
81 views

Safe MAC proof check

Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$. Is the following $MAC$ safe? Show your proof. $Mac'(k,m) = Mac(k, m)$ $Vrfy'(k,m,t) = \{Vrfy(...
southpaw22's user avatar
1 vote
0 answers
436 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
Petr Dvořák's user avatar
1 vote
0 answers
48 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
Parthian Shot's user avatar
1 vote
0 answers
282 views

Confidentiality then Integrity with different keys

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
user32182's user avatar
1 vote
0 answers
735 views

CBC MAC and DES combined question?

Suppose that we want to develop a MAC scheme which is as secure as Triple-DES CBC-MAC and at the same time as efficient as Single-DES CBC-MAC. We come up with the following idea: Except the last ...
supersonic's user avatar
1 vote
0 answers
227 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES (...
Simon Rühle's user avatar
0 votes
2 answers
182 views

What hash algorithm/construction to use to prove Data Availability?

I'm looking for a keyed hash function to use as part of an interactive proof where the Prover proves that they have the entirety of a data block that the Verifier also has. In my application I'm able ...
AJMansfield's user avatar
0 votes
0 answers
30 views

Is the CFB mode of Encryption related-key secure

I am going through the paper https://www.iacr.org/archive/fse2013/84240283/84240283.pdf where the related key security of CBC mode of encryption is well analyzed. I am concerned about whether the CFB ...
Crypto_Lover's user avatar
0 votes
0 answers
30 views

Shared taxonomy for hash, mac and digital signature algorithms and output?

I'm creating a cryptography API, and because naming things is hard, I'm trying to define a common name that identifies functions that accept input of arbitrary length and produce either digital ...
Les Hazlewood's user avatar