Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

33 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
280 views

Is CMAC vulnerable to length extension attacks?

Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$? Here is the CMAC picture from Wikipedia where it is only part ...
4
votes
0answers
195 views

is a MAC defined by a pseudo random generator secure?

Let $ G:\{0,1\}^*\rightarrow\{0,1\}^*$ be a length doubling PRG, and let $ \Pi=(Gen,Mac,Vrfy)$ be the following MAC scheme: $ Gen $ on input $ 1^n$ uniformly samples and outputs $ k\leftarrow \{0,1\...
4
votes
0answers
94 views

Which compression functions are MACs?

The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed). How does this relate to common assumptions for ...
4
votes
0answers
499 views

uf-cma and uf-cmva probabilistic MAC

Is there any simple probabilistic MAC $\Pi=(\operatorname{Gen},\operatorname{Tag},\operatorname{Vrfy})$ with UF-CMA security but without UF-CMVA security? How can an attacker efficiently use the $\...
4
votes
0answers
462 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
4
votes
0answers
118 views

Why reveal MAC-keys after using them?

As far as my understanding goes MACs are used to determine whether the received message comes from a source that has access to a MAC-key which is known by both parties. Some crypto protocols reveal ...
4
votes
0answers
152 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
3
votes
0answers
69 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
3
votes
0answers
54 views

1-digit MAC with error-catching properties?

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
3
votes
0answers
149 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
2
votes
0answers
34 views

Attackability of one-time MAC when using block mode

Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially....
2
votes
0answers
72 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
2
votes
0answers
37 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
2
votes
0answers
151 views

Using NIST constructions based on Keccak like cSHAKE128 for other sponges

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC. All this schemes come with a security guarantee and are ...
1
vote
0answers
42 views

Circular Security - Encrypting the key with the key

I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
1
vote
0answers
75 views

Generating a MAC on a Polynomial

In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
1
vote
0answers
72 views

A modification of the NMAC construction

Consider the NMAC construction: This is a proposed exercise in my notes: Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$? In ...
1
vote
0answers
49 views

Parallel MAC vs doubled rounds for SipHash, KMAC and others

SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option. I was wondering from a security perspective how this would compare ...
1
vote
0answers
96 views

PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...
1
vote
0answers
49 views

MAC with key supplied afterwards

Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
1
vote
0answers
72 views

Safe MAC proof check

Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$. Is the following $MAC$ safe? Show your proof. $Mac'(k,m) = Mac(k, m)$ $Vrfy'(k,m,t) = \{Vrfy(...
1
vote
0answers
162 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
1
vote
0answers
42 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
1
vote
0answers
225 views

Confidentiality then Integrity with different keys

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
1
vote
0answers
138 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute (L·...
1
vote
0answers
296 views

Which of these is a secure MAC?

Let (S,V) be a secure MAC defined over $(K,M,T)$ where $M = \{0,1\}^n$ and $T =\{0,1\}^{128}$. Which of the following is a secure MAC: $S'(k,m) = S(k,m)[0,\ldots,126]\quad and \quad V'(k,m,t) = \big[...
1
vote
0answers
603 views

CBC MAC and DES combined question?

Suppose that we want to develop a MAC scheme which is as secure as Triple-DES CBC-MAC and at the same time as efficient as Single-DES CBC-MAC. We come up with the following idea: Except the last ...
1
vote
0answers
209 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES (...
0
votes
0answers
40 views

XORing Algorithm Outputs To Guard Against Breakthroughs

My question is how safe is XORing two algorithm outputs together... ...For Symmetric Encryption: Master key from CSPRNG ==> MK HKDF-Expand(...
0
votes
0answers
44 views

Is attack against secret prefix possible for messages of any size?

I am aware of message extension attack on MACs constructed with a hash function that uses Merkle-Damgård scheme. $$MAC=h(k,x)$$ I am interested if this attack only works if $0 ≡ x$ mod (hash input ...
0
votes
0answers
42 views

Security of this parallelizable two-pass authentication scheme

This is only the authentication half of a block cipher mode of operation that provides authenticated encryption. The part that provides encryption is left out (it can be CBC, PCBC, ECB, or whatever). ...
0
votes
0answers
152 views

How does “one-pass” authentication differ from “two-pass”?

The meaning of "one-pass authentication" as well as its difference from "two-pass authentication" has not been explained to my satisfaction. CCM mode, EAX mode, and HMAC are examples of the first type;...
0
votes
0answers
44 views

Non CPA on custom MAC

While preparing for a crypto exam there is a task we don't really understand: task Let $E_K$ be a permutation $\{0,1\}^b \rightarrow \{0,1\}^b$ defined by a blockcipher with the key $K$. Let $M = (...