# Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

429 questions
Filter by
Sorted by
Tagged with
56 views

### Can poly1305 be used as an error-correction code?

Given a message $m$ of size $n$, a key $k$, and a message authentication code $mac = poly1305(m, k)$ what is the minimum amount of bitflips on the message that can be corrected (or at least detected) ...
87 views

### The output size is smaller than input size is a insecure to hash function

Why it will be unsafe, and can be break?
34 views

### Attackability of one-time MAC when using block mode

Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially....
40 views

### XORing Algorithm Outputs To Guard Against Breakthroughs

My question is how safe is XORing two algorithm outputs together... ...For Symmetric Encryption: Master key from CSPRNG ==> MK HKDF-Expand(...
4k views

### How is HMAC hashed message decrypted on the receiver side

We know that MAC algorithm and key are used in both sender and receiver side to get the matching MAC tages to prove that the data is authentic. Now in HMAC we know that, it makes use of crytographic ...
136 views

### Using Permutation polynomial to compute a MAC

Is the following MAC secure? For a block $y_i$ in a file, we defined a MAC as follows: $Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$. Where $p$ is a prime number, $g \in \mathbb{G}$,$PRF(k,i)$ is ...
73 views

### Composition of X25519+XSalsa20+Poly1305

In an correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
53 views

### Attack on envelop mac

As I am reading the Paper: MDx-MAC and building fast MACs from hash functions I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...
42 views

### Circular Security - Encrypting the key with the key

I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
70 views

### Can we get the msg when we know tag and key in Poly1305

Assume $tag[i]=\operatorname{MAC}(key[i],msg)$ Now we know: $tag,tag,\ldots,tag[n]$ $key,key,\ldots,key[n]$ Can we get the $msg$ from this? Or can we get the $tag$ of this $msg$ using ...
6k views

### Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
33 views

69 views

### What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
875 views

### DUKPT MAC Variant key [closed]

I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC ...
326 views

### Key size vs output size of a MAC

What is more important, in terms of security, the size of the MAC or the size of the key that it uses? I'm asking this because I have to answer the following homework question: What is more secure? ...
74 views

### Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags（non-deterministic）？

If we use non-deterministic MACs in encrypt-and-authenticate approach， is it secure？
Given two MAC schemes $\prod_1 = (keyGen_1, S_1, V_1)$ and $\prod_2=(keyGen_2, S_2, V_2)$. $\prod_3$ runs $keyGen$ from $\prod_1$ and $\prod_2$, respectively, to obtain $(k_1, k_2)$. $\prod_3$, where ...