Questions tagged [mac]
(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.
62
questions with no upvoted or accepted answers
5
votes
0
answers
179
views
Why reveal MAC keys after using them?
As far as my understanding goes, MACs are used to determine whether the received message comes from a source with access to a MAC-key, which both parties know.
Some crypto protocols reveal their used ...
- 131
4
votes
0
answers
82
views
Practical attack on MD5(key || fixed-length-message) as MAC?
I wonder if there is any practical attack on MD5(key || fixed-length-message).
- 163
4
votes
0
answers
288
views
is a MAC defined by a pseudo random generator secure?
Let $ G:\{0,1\}^*\rightarrow\{0,1\}^*$ be a length doubling PRG, and let $ \Pi=(Gen,Mac,Vrfy)$ be the following MAC scheme:
$ Gen $ on input $ 1^n$ uniformly samples and outputs $ k\leftarrow \{0,1\...
- 49
4
votes
0
answers
106
views
Which compression functions are MACs?
The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed).
How does this relate to common assumptions for ...
- 4,883
4
votes
0
answers
663
views
uf-cma and uf-cmva probabilistic MAC
Is there any simple probabilistic MAC $\Pi=(\operatorname{Gen},\operatorname{Tag},\operatorname{Vrfy})$ with UF-CMA security but without UF-CMVA security?
How can an attacker efficiently use the $\...
4
votes
0
answers
834
views
Can a secure MAC break if the adversary is given oracle access to Verify?
In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
- 141
4
votes
0
answers
190
views
ECIES: Purpose of optional shared information?
According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows:
Generate a random shared secret $Z$ according to ECIES, which will never be ...
- 75
3
votes
1
answer
145
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
3
votes
0
answers
88
views
What was used for symmetric message authentication before HMAC was invented?
Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else?
I know about NIST FIPS 113 "Data Authentication Algorithm" ...
- 794
3
votes
0
answers
59
views
1-digit MAC with error-catching properties?
The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
- 134k
3
votes
0
answers
180
views
Authenticated encryption with Enc-Sign-Mac
I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
2
votes
0
answers
54
views
Designated verifier signature from Diffie–Hellman and a MAC
Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
- 206
2
votes
0
answers
213
views
Is the following derived MAC where the output is XOR'ed with the key secure?
Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck .
More details:
It's just any reduction ...
- 73
2
votes
0
answers
238
views
TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message
I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
- 21
2
votes
0
answers
232
views
What is the original paper of the length extension attack on hash based MAC functions
A message authentication code (MAC) based on using a hash function with the secret prefix $H(k||m)$ technique goes back to two independent sources according to Tsudik's article on 1992;
S. Crocker, S....
- 46k
2
votes
0
answers
49
views
Attackability of one-time MAC when using block mode
Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially....
- 161
2
votes
0
answers
136
views
Security of MAC-Then-Encrypt without MAC key authentication
We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
- 43
2
votes
0
answers
103
views
Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?
I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it.
The ...
- 21
2
votes
0
answers
187
views
Using NIST constructions based on Keccak like cSHAKE128 for other sponges
NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC.
All this schemes come with a security guarantee and are ...
- 2,508
2
votes
0
answers
201
views
Why does OMAC2 exist?
The specification for OMAC has the following to say about OMAC2:
For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute (L·...
- 21
2
votes
0
answers
457
views
Which of these is a secure MAC?
Let (S,V) be a secure MAC defined over $(K,M,T)$ where $M = \{0,1\}^n$ and $T =\{0,1\}^{128}$. Which of the following is a secure MAC:
$S'(k,m) = S(k,m)[0,\ldots,126]\quad and \quad V'(k,m,t) = \big[...
- 45
1
vote
0
answers
92
views
Quantum-Safe MAC: HMAC and CMAC
If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
- 153
1
vote
0
answers
39
views
Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?
Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC
$ Tag:\{0,1\}^\lambda \...
- 33
1
vote
0
answers
81
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
1
vote
0
answers
77
views
Trying to understand this Solution related to CCA security
4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
- 11
1
vote
0
answers
69
views
Can you use Output Feedback Mode (OFB) to construct a Message Authentication Code (MAC)
Suppose $f_k$ is an arbitrary block cipher. Can OFB via $f_k$ be used to make a MAC. I argue that you can't even with fixed l, $m = l \times k$ because in OFB, $\mu = f_k(f_k(...((IV))) \oplus m$, and ...
- 41
1
vote
0
answers
119
views
Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?
The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
- 111
1
vote
0
answers
108
views
Proof check: Forgery for a MAC
I'm looking at the MAC defined as follows: $$\text{Mac}_k(m)=\langle r,f_k(r\oplus m)\rangle $$ where $r$ is uniformly chosen at random (each time) and $f_k$ is a PRF. Vrfy is the canonical one. I'm ...
- 21
1
vote
0
answers
184
views
Forgery of the Carter-Wegman MAC
Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
- 41
1
vote
0
answers
96
views
Insecure pseudo random functions
Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key):
$(a)$ To authenticate a ...
- 41
1
vote
0
answers
241
views
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
The title mostly explains it;
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
- 11
1
vote
0
answers
90
views
Implementing MAC with PRF family $f$, why do we need $f_k$ to be invertible?
As per the title, say we have $\text{MAC}(k,m) = (m,f_k(m))$ where $f$ is a PRF family and every function $f_k$ is PRP, where $f_k(m)$ and $f_k^{-1}(m)$ are efficiently computable. I proved that this ...
- 11
1
vote
0
answers
113
views
Circular Security - Encrypting the key with the key
I know this isn't the best practice, but what if I took a cheap/fast 128-bit
stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
- 315
1
vote
0
answers
101
views
Generating a MAC on a Polynomial
In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
- 432
1
vote
0
answers
94
views
A modification of the NMAC construction
Consider the NMAC construction:
This is a proposed exercise in my notes:
Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$?
In ...
- 1,231
1
vote
0
answers
73
views
Parallel MAC vs doubled rounds for SipHash, KMAC and others
SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option.
I was wondering from a security perspective how this would compare ...
- 324
1
vote
0
answers
141
views
PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?
I think the question was asked somewhere else but not answered very precisely.
Quoting from the "Handbook of applied cryptography":
Identification based on PK decryption and witness.
Consider ...
- 11
1
vote
0
answers
53
views
MAC with key supplied afterwards
Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
- 90.2k
1
vote
0
answers
81
views
Safe MAC proof check
Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$.
Is the following $MAC$ safe? Show your proof.
$Mac'(k,m) = Mac(k, m)$
$Vrfy'(k,m,t) = \{Vrfy(...
- 189
1
vote
0
answers
364
views
How to normalize data of a generic HTTP request for the purpose of signing
I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
- 151
1
vote
0
answers
46
views
Which protocols / file formats use CBC with a random IV and without a MAC?
Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here.
The ...
- 111
1
vote
0
answers
273
views
Confidentiality then Integrity with different keys
Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 :
Can do a little better - about 1.5 “encryptions”
The whole ...
- 11
1
vote
0
answers
719
views
CBC MAC and DES combined question?
Suppose that we want to develop a MAC scheme which is
as secure as Triple-DES CBC-MAC and at the same time as efficient as Single-DES
CBC-MAC. We come up with the following idea: Except the last ...
- 11
1
vote
0
answers
227
views
Security of .net AES implementation and security of a hash MAC
My question rather splits into two sections:
Is AES correctly and security implemented in the .net Framework?
Are there any reviews of implementation mistakes that would weaken the security of AES (...
- 337
0
votes
0
answers
29
views
Verify HMAC tag without knowing the key
Let's say there's Alice and Bob.
Let Alice and Bob agree on a message $M_1$, a tag $T_1$, and a function $HMAC$.
Alice proves to Bob that she knows a key $K$ such that $T_1 = HMAC(M_1, K)$ without ...
- 315
0
votes
0
answers
63
views
Is my domain separation in stream cipher and MAC accepted?
I would like to implement domain separation in encryption/decryption along with MAC.
The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
- 125
0
votes
0
answers
22
views
MAC Generation in ZUC: why is the test data non-byte aligned?
Short question: is there a particular reason why all standardized test data for the input message for 128-EIA3 is non-byte aligned?
- 1
0
votes
0
answers
29
views
Has reducing MAC size and increasing message size the same effect on security?
I am evaluating ways to reduce the overhead of (H)MACs on small messages. I was primarily wondering if there is a difference between halving the MAC length or keeping the same MAC length but using it ...
- 101
0
votes
0
answers
74
views
MAC Security - MAC verification queries
In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that an adversary that is also capable of requesting the challenger for verification queries (in addition to ...
- 1,068
0
votes
0
answers
47
views
Algorithm to validate 1 of N inputs is part of output hash
Is there an algorithm that allows proofing that an input x1 was used as 1 out of N inputs to create an output hash y, without ...
- 123