Questions tagged [mac]

(or message authentication code), a short piece of information used to authenticate a message, and the algorithm to create and check such information, using a secret key.

Filter by
Sorted by
Tagged with
2
votes
0answers
43 views

Attackability of one-time MAC when using block mode

Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially....
0
votes
0answers
59 views

XORing Algorithm Outputs To Guard Against Breakthroughs

My question is how safe is XORing two algorithm outputs together... ...For Symmetric Encryption: Master key from CSPRNG ==> MK HKDF-Expand(...
3
votes
1answer
877 views

Composition of X25519+XSalsa20+Poly1305

In a correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
1
vote
1answer
77 views

Attack on envelop mac

As I am reading the Paper: MDx-MAC and building fast MACs from hash functions I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...
1
vote
0answers
64 views

Circular Security - Encrypting the key with the key

I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
2
votes
1answer
82 views

Can we get the msg when we know tag and key in Poly1305

Assume $tag[i]=\operatorname{MAC}(key[i],msg)$ Now we know: $tag[0],tag[1],\ldots,tag[n]$ $key[0],key[1],\ldots,key[n]$ Can we get the $msg$ from this? Or can we get the $tag$ of this $msg$ using ...
2
votes
1answer
49 views

Signature over MAC value for a random key

Would it be possible to create a signature scheme like this: $ \DeclareMathOperator{Gen}{Gen_{\Mac}} \DeclareMathOperator{Mac}{Mac} \DeclareMathOperator{Sign}{Sign} \DeclareMathOperator{F}{F} \...
2
votes
1answer
61 views

Non Repudiation - Message Authentications methods

According to a definition given by my professor: Message authentication methods verify that the message is from the right sender, however they don't guarantee non-repudiation. To me this sounds ...
0
votes
1answer
53 views

Would a non-envelop, prefix only, SHA2 built MAC be susceptible to key recovery attacks?

When aiming to build a MAC, classic literature discusses the use of Envelopes or key "Sandwich" to build MACs. These were proved to be as secure as HMAC in “Sandwich” Is Indeed Secure: How to ...
1
vote
1answer
61 views

Does the ability to influence the key of a MAC effects its security?

If a PPT adversary can influence the key of a MAC function, is it still secure? For example, if we define $f$ as follow: $f(r,x) = HMAC_{(k\oplus r)}$(x) If the adversary has oracle access to $f$, ...
2
votes
1answer
186 views

Existence of MAC implies existence of OWF

I'm having trouble understanding how the existence of a MAC implies the existence of an OWF. If the MAC protocol is $(\operatorname{Gen}, \operatorname{MAC}, \operatorname{Ver})$ such that for any ...
1
vote
0answers
88 views

Generating a MAC on a Polynomial

In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
1
vote
1answer
60 views

Is it safe to compute HMAC(Base64(IV) || "," || Base64(CipherText)) instead of HMAC(IV || CipherText)?

Let || be the concatenation operator. Let CipherText = AES(Key1, IV, Message). Let us assume AES is used in CBC mode. I want ...
2
votes
1answer
482 views

How are AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M related?

I am using OpenSSL 1.1.1 to implement a TLS 1.3 communication module so I tried to learn how data integrity and authentication is ensured. I read a lot about AEAD, GCM, CBC, Poly1305, EtM, MtE and E&...
1
vote
1answer
184 views

XCBC Authentication

So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
0
votes
0answers
52 views

Differences between MAC and HMAC [duplicate]

After reading many posts, I am still confused about the differences between these two. Let me know if my understanding is correct: MAC is encrypted string that is generated using a secret key and a ...
2
votes
2answers
248 views

Parallelizing MACs by subdividing the message and then aggregating results

Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC. Could these be securely parallelized by computing multiple MACs in parallel and then combining the ...
0
votes
1answer
117 views

Which HMAC scheme more secure?

Which HMAC scheme is more secure? Or are they of the same level of security? Scheme One Compute a HMAC on the data to encrypt (cleartext/plaintext) Encrypt the data with AES_CTR_256, and append ...
0
votes
1answer
221 views

Is using the same MAC twice insecure?

I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key. Here is the full recipe: Compute a HMAC on the data to encrypt, and append it to the ...
2
votes
0answers
120 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
2
votes
1answer
133 views

Zero Knowledge Proofs: to establish a public key cryptography encryption

I am very interested to know in the general sense how two parties who know each other are able to continue a conversation IF and ONLY IF they both earn the same salary. For example, we have a person X ...
2
votes
2answers
393 views

Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?

Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
0
votes
1answer
54 views

specific scenario question relating to using NACL crypto_box in a protocol

Scenario 1: SenderA sends message1 to ReceiverB message1 is encrypted using NACL crypto_box using SenderA secret key and ReceiverB public key. we understand that the NACL crypto_box authenticator ...
0
votes
1answer
713 views

How to decide whether to use digital signature (RSA) or HMAC

I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other? These are some examples: HMAC SHA256 vs RSA SHA256 - which one to use What are the ...
0
votes
1answer
127 views

It is the IV shared in CBC mode?

I don't know if the IV in CBC mode is equal in both sides of the encryption and decryption operations. I know that the IV must be unpredictable, but has it to be MACed in the encryption side to be ...
2
votes
1answer
151 views

Why there isn't a consistent key transform function of HMAC?

I am currently learning, the internal working of HMAC. There exists a key transformation process in the beginning, which works as follows:- Make the length of $K$ (Key) equal to $B$ (number of bits ...
3
votes
2answers
573 views

Setting MAC field to all-zero to indicate unencrypted data

I'm currently working on a project where we transmit data between two systems. The data is generally encrypted before transmission, however there are certain transmissions that are unencrypted. We ...
2
votes
0answers
75 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
3
votes
0answers
77 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
2
votes
1answer
534 views

SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
2
votes
1answer
111 views

Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags(non-deterministic)?

If we use non-deterministic MACs in encrypt-and-authenticate approach, is it secure?
1
vote
1answer
399 views

What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?

I have messages with the following fixed lengths: 4 byte 8 byte 16 byte I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g....
0
votes
2answers
83 views

Who can create a MAC? Who can verify a MAC?

I have read many answers but I cannot get the basic explanation. There's no need for full details. I just need some basic information about who can create a mac and verify it.
1
vote
0answers
570 views

Proof of secure MAC [duplicate]

I'm studying about MAC and followings are definition of secure MAC. (This is Def 4.2 and Def 4.3 of "J.Katz and Y.Lindell-Introduction to Modern Cryptography") I want to prove this ...
2
votes
1answer
60 views

When extending the domain of a fixed-length MAC, why do we have to include the message length in each block?

In Katz's text (2nd edition), it states in 4.3.2: The truncation attack can be thwarted by additionally authenticating the message length along with each block. (Authenticating the message ...
1
vote
1answer
378 views

How does the squeeze function in the NaCl Poly1305 implementation work?

The NaCl ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()): ...
1
vote
1answer
585 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
2
votes
1answer
223 views

Hash for use in embedded HMAC application

I developed a GNSS logger (http://flysight.ca) which has become popular for scoring skydiving competitions. At the moment, there is little protection against competitors falsifying tracks, but I would ...
1
vote
0answers
89 views

A modification of the NMAC construction

Consider the NMAC construction: This is a proposed exercise in my notes: Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$? In ...
-1
votes
1answer
86 views

Length extension attack for file download

I am trying to understand the length extension attack. I found this tutorial where the author performs length extension on a file download URL. Original URL: http://example.com/download?file=...
3
votes
0answers
56 views

1-digit MAC with error-catching properties?

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
4
votes
2answers
203 views

Why is this MAC flawed?

Consider a function to create a tamperproof cookie as follows: $$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$ where $m$ is a message provided by Alice, and k is a secret key known only to ...
4
votes
1answer
95 views

Difficulty of forging MACs based on linear functions over $GF\left(2^n\right)$

This is a homework question, therefore I'm not expecting full solutions, just general guidance. I want to build a one-time MAC using universal hashing. I defined my hash functions as: $h_{a,b}:\...
0
votes
1answer
165 views

Two-way secret sharing for authentication?

Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ...
1
vote
1answer
181 views

Is this MAC correct and secure?

Let $m \in \{0, 1\}^{2n} = m_1 || m_2$. Let's also assume that $F_k$ is a PRF and $G$ is a PRG defined as $G: \{0, 1\}^n \rightarrow \{0, 1\}^n$. Now, Let's define the $MAC$ scheme as follows: $$MAC(...
1
vote
1answer
208 views

Is the scheme $(r, Mac_k(r) \oplus m)$ CPA-secure?

I honestly admit this question is taken from a h.w assignment: Prove or refute: the following encryption scheme is CPA-secure: Let $(\text{Gen}, \text{Mac}, \text{Vrfy})$ be a secure MAC with tags ...
5
votes
1answer
399 views

Are there any non Canonical Verifiable Cryptographic MACs

In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs; Canonical verification. For deterministic message authentication codes (that is, ...
5
votes
1answer
3k views

ISO 9797-1 MAC Algorithm 3 and Doc 9303-11 [closed]

I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 ...
0
votes
1answer
613 views

Show that if a fixed key MAC is not collision resistant then the MAC function is not computation resistant for every key K

I'm really having some trouble with this one. Let $H$ be a MAC function. For every key $K$ we can create an unkeyed hash function (i.e.an MDC) by using $H$ to hash messages with the fixed key $K$. ...
7
votes
2answers
666 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...

1 2
3
4 5
11