Questions tagged [mac]
(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.
559
questions
414
votes
13
answers
177k
views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
- 86.1k
237
votes
2
answers
133k
views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
- 2,668
60
votes
2
answers
18k
views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
- 703
56
votes
2
answers
67k
views
What is the difference between MAC and HMAC?
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
42
votes
1
answer
43k
views
Ciphertext and tag size and IV transmission with AES in GCM mode
I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
- 1,365
40
votes
4
answers
5k
views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
- 24.6k
39
votes
2
answers
30k
views
AES-GCM recommended IV size: Why 12 bytes?
When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.
Let's assume a ...
- 493
37
votes
4
answers
9k
views
Why is plain-hash-then-encrypt not a secure MAC?
It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why?
Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
- 1,101
28
votes
2
answers
25k
views
HMAC vs MAC functions
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.
What are principle differences?
When to use one and when the other?(Typical Use Cases)
- 1,131
27
votes
1
answer
23k
views
Use cases for CMAC vs. HMAC?
Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is ...
- 356
26
votes
2
answers
6k
views
Is HMAC needed for a SHA-3 based MAC?
HMAC does nested hashing in order to prevent Length Extension Attacks.
Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
- 499
25
votes
1
answer
4k
views
Why is SHA-3 robust against Length-Extension Attacks?
If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?
- 351
25
votes
4
answers
5k
views
Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
- 134k
24
votes
2
answers
5k
views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mathbin\| x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k \...
24
votes
2
answers
3k
views
Definition of "pepper" in hash functions
I am confused about the notion of "pepper" in the context of storing hashes of users' passwords.
Definition 1: A pepper is a secret key
Looking around the Internet, for example here or here, ...
- 535
23
votes
3
answers
3k
views
Why is Poly1305 popular given its 'sudden death' properties?
ECDSA has the undesirable property that if a key pair reuses a nonce in a signing operation, the cryptosystem experiences catastrophic failure in the form of private key leakage. I've heard this ...
- 333
22
votes
2
answers
19k
views
What is the purpose of four different secrets shared by client and server in SSL/TLS?
I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including
client write mac secret,
server write mac secret,
server write key,
client ...
- 1,883
20
votes
2
answers
12k
views
Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?
A fixed length CBC-MAC uses an all-zero block as the initialization vector.
Suppose that we used a randomized IV instead, and sent the IV along with the tag.
So if the message $m$ will be $m = b_1 || ...
- 1,933
20
votes
2
answers
3k
views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = \mathrm{hash}(k||\mathrm{data})$...
Daniel
19
votes
3
answers
3k
views
UMAC: to what extent is it in use today?
Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ...
user46
19
votes
2
answers
2k
views
Can I use HMAC-SHA1 in counter mode to make a stream cipher?
Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey).
Would it be secure to feed it like a block cipher in counter mode to get a ...
- 538
18
votes
5
answers
3k
views
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense.
Context: I'm doing some crypto as a ...
- 283
18
votes
1
answer
3k
views
Cryptographically secure keyed rolling hash function
I could not find any mention on the Internet of a proven/known cryptographically secure keyed rolling hash function (ie rolling MAC). Has the question been studied, is it possible to build one ?
By ...
- 350
17
votes
2
answers
7k
views
Why is h(m||k) insecure?
Here is the post that explains the failure for doing h(k||m) and I understand it.
But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain?
- 333
17
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
- 271
16
votes
6
answers
6k
views
Why MACs are so important despite digital signatures doing everything a MAC can do and more?
When an entity $A$ wants to send a message to entity $B$, he can attach a MAC to the message. Entity $B$ on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
- 1,070
16
votes
2
answers
3k
views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
- 24.6k
14
votes
2
answers
2k
views
Can any MAC be used as a KDF?
First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
- 243
13
votes
1
answer
2k
views
Why does HMAC use two different keys?
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?
See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\...
- 429
13
votes
2
answers
2k
views
How is HMAC(message,key) more secure than Hash(key1+message+key2)
I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction.
What I don't understand is, how or why is $\...
- 1,397
13
votes
1
answer
5k
views
Why do we encrypt-then mac but sign-then-encrypt?
This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so:
The general advice for applying ...
user46
12
votes
3
answers
3k
views
What happened to Poly1305AES? Is it obsolete?
I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, ...
- 349
12
votes
2
answers
2k
views
Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?
I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and ...
- 223
12
votes
1
answer
3k
views
For a one-time pad, which MAC method is information-theoretically secure?
In the the main post about MAC methods it mentions a few methods:
Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
- 368
11
votes
4
answers
7k
views
What is the advantage of digital signatures over message authentication codes?
Studying for CISSP these choices seemed limited:
What is the advantage of digital signatures over message authentication codes?
Digital Signature provides integrity verification while ...
- 119
11
votes
2
answers
3k
views
Why would Carter-Wegman-style message authentication not be broken by P = NP?
Researching about the implications of P = NP to cryptography I found someone say that the only cryptography left standing would be the one time pad and Carter-Wegman-Style message authentication. ...
- 243
11
votes
1
answer
516
views
Can Skein be used as a secure MAC in format H(k || m)?
Can Skein be used as a secure MAC in format H(k || m)?
I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
- 145
11
votes
9
answers
713
views
Physical analogue for MACs
What would be a good analogue with which to describe Message Authentication Codes to a person who has little to no understanding of cryptography?
For instance, a vault is a reasonable analogue for ...
- 10.9k
11
votes
3
answers
2k
views
Is Poly1305 an information-theoretically secure MAC?
I have heard some people say that the Poly1305 authenticator is a "nuclear" MAC i.e. it is information-theoretically secure. After reading the paper I see it is based on the Wegman-Carter MAC which is ...
- 368
11
votes
1
answer
4k
views
Why is H(message||secret_key) not vulnerable to length-extension attack?
Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$.
Why can't he perform the same ...
- 113
10
votes
1
answer
4k
views
The difference between MAC algorithms and what to use
I've been looking into message authentication codes and found several ways to create integrity for a message. I know of the following algorithms:
HMAC, this can use any cryptograhpic hash function ...
- 946
10
votes
1
answer
5k
views
Can I use a HMAC for Replay Attack protection?
I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
- 195
10
votes
1
answer
2k
views
Regular MACs vs Carter-Wegman MAC
Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc).
...
- 726
10
votes
1
answer
349
views
How would you encrypt-then-MAC when using pen-and-paper and a Caesar cipher?
I'll probably get shot for asking this, but I've got some kids (aged 8-10) in my neighbourhood that I've been showing/teaching the simple pen-and-paper Caesar cipher and they're successfully playing ...
- 17.7k
10
votes
1
answer
1k
views
How does NaCl Poly1305 implementation do modular multiplication?
The NaCl ref implementation of Poly1305 performs modular multiplication to calculate a polynomial $\mod 2^{130} - 5$ using the following modular multiplication ...
- 1,968
10
votes
1
answer
2k
views
Why are MACs in general deterministic, whereas digital signature constructions are randomized?
The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
- 2,410
9
votes
3
answers
3k
views
Is a secure deterministic MAC always a PRF?
Given a secure MAC scheme $ \Pi=(Gen, Mac, Vrfy) $, wheres $ Gen $ produces uniformly distributed keys, and the algorithm $ Mac $ is deterministic, is $ Mac $ necessarily a pseudorandom function?
I ...
- 245
9
votes
2
answers
2k
views
Keys in HMAC and NMAC
I'm quite new to this topic and have several questions concerning HMAC and NMAC:
Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the ...
- 193
9
votes
2
answers
1k
views
Why have hashes when you have MACs?
It would seem to a naive eye that if you have a MAC, you have a hash function: use a key that all the parties know (such as all-bits-zero).
A potential application would be a resource-constrained ...
9
votes
1
answer
1k
views
Which MAC scheme is quantum resistant?
Will HMAC resist Grover's algorithm? If not, which MAC scheme will provide post-quantum security?
- 93