Questions tagged [hmac]

HMAC is a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
0
votes
1answer
58 views

Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?

Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is: take a secret material which will work as "generator&...
0
votes
1answer
42 views

Authenticated, Quantum-resistant GPG2?

GPG2 does not provide authentication. It still uses SHA-1 by default. It does not seem to get any stronger as time goes by. If one were to pass a randomly-generated symmetric key (from a TRNG) over ...
0
votes
1answer
38 views

Is it safe to use the same password/secret for both VeraCrypt volume and its HMAC?

I am trying to script the integrity check of a VeraCrypt volume. ...
2
votes
2answers
99 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
4
votes
1answer
562 views

How is it possible that these two encryption functions yield the same result?

I opened this post in stackoverflow some time ago where I explained a problem I had about not finding a way that would allow to successfully get the result of a string encrypted with a "aes-256-...
0
votes
1answer
32 views

HMAC SHA256 - fixed vs dynamic key - security and collision impacts

Assume we should apply an hmac sha256 on different messages made of incremental numbers (Ex. 1 to 1 billion). Does it make sense in terms of security to apply a different fixed key for each message? ...
2
votes
1answer
81 views

With AES encryption and a known key and plaintext, can an attacker create a different key and plaintext resulting in the same ciphertext?

In short: with AES encryption can an attacker create a new key2 and plaintext2 so that AESkey1(plaintext1) = AESkey2(plaintext2) If so, can it be solved by just applying for instance a MAC like AES-...
1
vote
1answer
45 views

HMAC for hash list

If I have a very large input to hash with a hash function vulnerable to length extention and I am using a hash list, should I HMAC each part of the input or just HMAC the final hash of all the hashes ?...
0
votes
1answer
63 views

Using HMAC with AES modes that do NOT require padding [closed]

I'm trying to use HMAC with AES modes that do not require any sort of padding. Although I am aware that modes like AES-GCM and ...
5
votes
1answer
56 views

OpenSSL FIPS integrity check

As far as I know, FIPS requires a set of self tests (POST) to verify the cryptographic algorithms permitted and the integrity of the module. These tests are performed at run-time, so OpenSSL does a ...
1
vote
1answer
59 views

What is the best way of deterministically choosing N of M, given 32 bytes of sha256?

I have a list of M=10,000..100,000 items and 32 bytes of sha256 H. I want to choose N=10..100 items (without order). Is there an efficient way to do this? Or should I use something like ...
1
vote
0answers
40 views

Why the salt is used as a key in the extract phase of HKDF?

What is the reason that in the HKDF standard (RFC5869), in the "extract" phase, the 'salt" parameter is instantiated as HMAC key, and the secret keying material 'IKM' is instantiated as HMAC input ...
0
votes
1answer
49 views

Is it okay to reuse a single symmetric key for a large volume of messages and HMACs, so long as “nonces” are randomly generated for both of them?

https://www.reddit.com/r/crypto/comments/fnku50/nonce_reuse_vs_iv_reuse/ Nonce reuse with the same key is catastrophic to security. The same premise holds for initialization vectors. If the key ...
0
votes
0answers
23 views

Integrity for mixture of encrypted/unencrypted database fields

I have multiple blobs each (symmetrically) encrypted with its own randomly generated key. Now I want to encrypt these blob keys with user keys and store them in a database. A table could have the ...
2
votes
1answer
81 views

Why Authenticated Encryption the same message again is not secure?

It is the Exercise 9.14 (9.1) from the book A graduate course in applied cryptography by Boneh and Shoup. Let $(E, D)$ be an AE-secure cipher. a. $E_1(k,m):=(E(k,m), E(k,m));$ $$D_1(k,(c_1,c_2)):= ...
0
votes
1answer
43 views

does using an HMAC protect against hash table DoS attacks?

For a hash set where the values are supplied by a third party, one concern is that an attacker can run a denial of service attack by creating many values that all fall into one bucket of the hash ...
2
votes
2answers
82 views

What is the difference between a PRF and a PRP, and are cryptographic hash functions the same as HMAC (PRFs or PRPS)?

I read one answer to a similar question that put forth that a hash function is distinct from a PRF, however I've also found materials purporting that cryptographic hash functions are PRFs, and I'm not ...
0
votes
1answer
57 views

Is it possible to affect the output of HMAC w/ SHA-512 by providing it with a custom message?

Consider an HMAC algorithm that uses SHA-512 with an unknown private key. Is it possible to affect its output, either partially or totally, by providing it with carefully crafted messages? For the ...
2
votes
0answers
63 views

Why is double encryption used to generate EphIDs in DP3T?

The most famous proposed COVID-19 application is DP3T. In this app a user constantly broadcasts EphIDs generated from a secret key as follows: $$EphID 1 || ... || EphID n = PRG( PRF(SK_t , “broadcast ...
0
votes
0answers
31 views

How to generate temporary Credentials for TURN server Using TURN REST API in Java

I am new to this site, hence I apologize for my English and way of phrasing the question. I am trying to generate temporary credentials to my TURN server using the TURN secret that I generated with ...
2
votes
1answer
98 views

Does pepper *require* an HMAC?

Assume you are already given a properly-salted, password hash $X$ from some slow PBKDF (e.g., like Argon2id). Now, you want to apply some large (~256-bit) secret "pepper" $S$ to it before storing it ...
-1
votes
1answer
33 views

how to predict a sequence for reverse engineering of a ticketing system [closed]

i am student in the fith year of college IT-science and a crypto noob. i have been wondering how the folwing sequence of ticket i bougth in all at once were built for : how they work or how they are ...
0
votes
0answers
146 views

How to bruteforce password from HMAC-SHA256 hash (if you have the key)?

Short of creating one's own script / program, is there an existing, readily available way of iterating through a list of potential passwords to find which one corresponds to a hash (HMAC-SHA256), ...
1
vote
1answer
63 views

Key at start or end of HMAC

In the book Information Security Principles and Practice, the author explains why HMAC should be used for integrity with a symmetric key with the message, to prevent a MiTM to replace both the message ...
1
vote
1answer
148 views

SHA1 standard steps

I'm a computer engineering student and I want to implement a cryptographic function for a college project. I want to realize my personal implementation of a WPA2 hash producer in C (and upload it to ...
1
vote
2answers
119 views

Can a MAC be used as a HMAC?

I am reading through an information security book right now, and a confusing question poses itself to me: "Could you use a MAC as a HMAC? That is, does a MAC satisfy the same properties that a ...
8
votes
1answer
1k views

How many codes can I safely generate using the same HMAC key?

Can an attacker guess the key given enough codes for the same key? And if so, how many times is it safe to use the same key?
1
vote
2answers
169 views

How to design a secure challange-response authentication protocol?

I am implementing a custom challenge-response protocol to authenticate a client to a server. Mutual authentication is not required, i.e. the server doesn't need to be authenticated to the client. The ...
0
votes
1answer
49 views

Using the output of HKDF directly

I am using HKDF with an IKM and salt, the OKM is used as the key for an HMAC operation. The HMAC algorithm is authenticating messages in a communications system The salt is the concatenation of 2 ...
0
votes
1answer
108 views

Length extension attacks, Merkle–Damgård constructions, and HMACs

The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks." However, HMACs can be ...
-1
votes
1answer
40 views

How to implement nonce for hashing a 6 digit sensitive number with hmac with its secret key

I have to pass a 6 digit number which has to be kept very secret through a unsecured netwok. I am thinking to hash it using hmac and a secret key which only me and the reciever knows So the code ...
1
vote
1answer
52 views

can I use PBKDF2 instead of hmac as a hashing tool for sensitive data

I have read about hmac and PBKDF2. PBKDF2 - is mainly used for password hashing. It uses ...
1
vote
1answer
88 views

Security Considerations in using SHA-1 for One Time Passwords

SHA-1 is considered broken. That's why I'm assuming that using SHA-1 for RFC2289 OTPs is broken as well. Is this assumption correct? Going further with this assumption using SHA-1 for RFC4226 HOTPs ...
2
votes
2answers
59 views

Can the HMAC of a pre-hash be considered equivalent to an HMAC of the message?

Assume: size of m = 1kB HMAC hashing function = SHA256 H hashing function = SHA256 It seems reasonable to think that there would be no difference in authenticating a message if either HMAC(k, m) or ...
-3
votes
1answer
124 views

The output size is smaller than input size is a insecure to hash function [closed]

Why it will be unsafe, and can be break?
0
votes
0answers
47 views

What's the use of HMAC in PBKDF2? [duplicate]

As far as I know, PBKDF2 uses an underlying pseudorandom function in order to generate a hash (like SHA256) so as far I understood PBKDF2 is basically a hash function that uses an underlying function ...
1
vote
1answer
139 views

Protect the original message of a hash from brute force

My apologies for the somewhat inaccurate terminology. Basically I have some simple messages (entropy ~50 bits) the user will use for registration. The messages should remain private, and I don't ...
1
vote
1answer
98 views

HMAC of message hash

If I have a message m and want its HMAC, I can simply do HMAC(k, m). But sometimes I am not given ...
0
votes
1answer
88 views

An unusual use-case for HMAC as compression function in web browsers

It's an unfortunate fact that, right now (2019), browsers don't expose standardized streaming hashing interfaces in SubtleCrypto. The only way to hash a file, is to ...
1
vote
1answer
104 views

Is it OK to just hash a symmetric key to derive an authentication key?

I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
0
votes
1answer
50 views

Termonology help: What is using AEAD without encrypting data called?

I'm using ChaCha20-Poly1305 in a "full AEAD" mode, where a payload of data is encrypted and a block of unencrypted "additional data" is secured as well. However, I'd like to also occasionally use the ...
0
votes
2answers
139 views

Does HMAC provide anything that AEAD does not?

Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available) Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
0
votes
0answers
79 views

Some curiosity about HMAC

Is the probability of distinguishing HMAC from a random oracle is the same as the probability of forging HMAC? Can we say that the following statement is trivial? $\Pr[\text{Forging $\operatorname{...
1
vote
1answer
135 views

are there more efficient methods than HMAC to achieve convergent encryption?

I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...
0
votes
0answers
46 views

Probability of collision of two HMACs with two random keys

Assume $k_1$ and $k_2$ are two $\lambda$ bit random number ($|k_1|=|k_2|=\lambda$), and HMAC generates $f(\lambda)$ bit tag. How much is the probability of their collision for an input message $m$? $...
1
vote
1answer
92 views

Is this function a secure MAC?

Consider the following function: $f_k(mm')=\operatorname{HMAC}_{\operatorname{HMAC}_k(m)}(mm')$ Can I use $f$ as a secure MAC?
1
vote
1answer
50 views

What is the best way to forge a tag for a determined message?

Assume a PPT adversary wants to forge a tag for a message. The adversary has oracle access to verification function. Adversary knows that tags are generated by HMAC-SHA256 with 128-bit key. I think ...
1
vote
0answers
47 views

Security of HMAC against an eavesdropper

Assume we are using HMAC-SHA-256 with 128-bit key for authenticating our messages, and an adversary has eavesdropped $n$ (message, tag) pairs. If the adversary wants to forge a tag for a message $m'$,...
1
vote
0answers
46 views

Yubico’s take on U2F wrapping: purpose of MAC?

I've been reading up on Yubico's implementation of U2F. I am confused on the purpose of the message authentication code (MAC). It prevents an attacker from providing a key handle (particularly a ...
1
vote
1answer
46 views

Forging a valid tag for an arbitrary message when you have some knowledge about the key

I am using HMAC-SHA256 with a 128-bit key. Assume my key generator leaks some information to an adversary. Hence, the adversary can predict the key with probability $\alpha$. Can I say that the ...

1
2 3 4 5
11