Hot answers tagged

40 votes

HMAC-SHA1 vs HMAC-SHA256

Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? Yes. That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the ...
user avatar
  • 131k
39 votes
Accepted

Key size for HMAC-SHA256

Short answer: 32 bytes of full-entropy key is enough. Assuming full-entropy key (that is, each bit of key is chosen independently of the others by an equivalent of fair coin toss), the security of ...
user avatar
  • 122k
37 votes
Accepted

HMAC vs ECDSA for JWT

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
user avatar
  • 131k
31 votes
Accepted

Why is HMAC-SHA1 still considered secure?

In the first section of this answer I'll assume that through better hardware or/and algorithmic improvements, it has become routinely feasible to exhibit a collision for SHA-1 by a method similar to ...
user avatar
  • 122k
29 votes
Accepted

Use cases for CMAC vs. HMAC?

HMAC was there first (the RFC 2104 is from 1997, while CMAC is from 2006), which is reason enough to explain its primacy. If you use HMAC, you will more easily find test vectors and implementations ...
user avatar
27 votes
Accepted

Is HMAC needed for a SHA-3 based MAC?

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC? No, you don't need to do ...
user avatar
  • 31.2k
24 votes
Accepted

Encrypt-then-MAC: Do I need to authenticate the IV?

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples. In CTR mode, an attacker who fiddles with the IV ...
user avatar
  • 10.9k
22 votes

HMAC-SHA1 vs HMAC-SHA256

I would use HMAC-SHA256. While poncho's answer that both are secure is reasonable, there are several reasons I would prefer to use SHA-256 as the hash: Attacks only get better. SHA-1 collision ...
user avatar
  • 31.2k
21 votes
Accepted

Can Skein be used as a secure MAC in format H(k || m)?

Length extension attack The reason why $H(k \mathbin\| m)$ is insecure with most older hashes is that they use the Merkle–Damgård construction which suffers from length extensions. When length ...
user avatar
21 votes

What size should the HMAC key be with SHA-256?

The only rule for the key is that it should at least contain 256 bits of randomness. If the key is smaller you may not get the full security of HMAC-SHA-256. The full security of HMAC is basically ...
user avatar
  • 84.5k
20 votes

Why does HMAC use two different keys?

Alas, there is no simple satisfactory answer to this question. What I can offer is a very strong property that $m \mapsto H\bigl(k \mathbin\| H(k \mathbin\| m)\bigr)$ fails to achieve; a more ...
user avatar
18 votes

Why is HMAC-SHA1 still considered secure?

When people say HMAC-MD5 or HMAC-SHA1 are still secure, they mean that they're still secure as PRF and MAC. The key assumption here is that the key is unknown to the attacker. $$\mathrm{HMAC} = \...
user avatar
18 votes

HMAC vs ECDSA for JWT

To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it: Insanely better performance: signing and ...
user avatar
  • 2,706
17 votes

Why not authenticate full-disk encryption?

Authentication and probabilistic encryption are two desirable features which each take up a small amount of extra space. And you are absolutely right that the percentage of space consumed is of no ...
user avatar
  • 1,377
16 votes
Accepted

How secure would HMAC-SHA3 be?

The Keccak submission says: From the security claim in [12], a PRF constructed using HMAC shall resist a distinguishing attack that requires much fewer than $2^{c/2}$ queries and significantly less ...
user avatar
15 votes
Accepted

Is PBKDF2-HMAC-SHA1 really broken?

Password hashes need first pre-image resistance and should not cause many collisions among typical passwords (preserve the entropy). This collision "attack" violates neither requirement and causes no ...
user avatar
15 votes

Could an HMAC be used as a hash?

HMAC remains unbroken with MD5 and SHA1 because it has a secret key that the attacker doesn't know. Therefore, the attacker cannot carry out huge computations on itself (as is required for finding ...
user avatar
14 votes
Accepted

How is HMAC(message,key) more secure than Hash(key1+message+key2)

The construction you are proposing is called the "envelope" or "sandwich" MAC, it predates HMAC, and it is in fact secure—provided the key and message are appropriately padded. That is, $$ \text{...
user avatar
  • 11.6k
14 votes

Why not authenticate full-disk encryption?

So, are there reasons for not using authentication that I'm missing? I believe that the real reason is not actually space, but time. As you said, storing the tags would not require that much space. ...
user avatar
  • 131k
13 votes

Authenticating a message with HMAC vs AES-CBC

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether ...
user avatar
  • 131k
13 votes
Accepted

Why not authenticate full-disk encryption?

With 4096-byte sectors, space is a complete non-issue, less than 1 % Problem 1: 10GB per TB is not a "complete non-issue" for many people. Problem 2: If the checksums are inside of their data ...
user avatar
  • 1,187
13 votes
Accepted

The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
user avatar
13 votes
Accepted

HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Both algorithms provide plenty of security, near the output size of the hash. So even though HMAC-512 will be stronger, the difference is inconsequential. If this ever breaks it is because the ...
user avatar
  • 84.5k
13 votes

What's the difference between PBKDF2 and HMAC-SHA256 in security?

HMAC is still very efficient. It's used in PBKDF2 not for the lower efficiency (that's handled by iterating it many times) because of the fact that it takes two inputs. That lets the password and ...
user avatar
12 votes
Accepted

Is there a null HMAC?

It is well defined. The hash function has no impact on whether HMAC is defined for a null string text argument. As long as HMAC is defined for a particular hash function, the resulting HMAC of a null ...
user avatar
12 votes
Accepted

How many trials does it take to break HMAC-MD5?

You can find a collision in MD5 at much lower cost than $2^{64}$ evaluations of MD5. You could do the same for HMAC-MD5, if you knew the key, which renders it unfit for unusual applications such as ...
user avatar
12 votes
Accepted

How many codes can I safely generate using the same HMAC key?

I don't think there is any official limitations when it comes from standardization bodies such as NIST. However, there do seem to be some papers such as New Generic Attacks Against Hash-based MACs. ...
user avatar
  • 84.5k
11 votes
Accepted

Is HMAC-MD5 still secure for commitment or other common uses?

No, message commitment by disclosing its HMAC-MD5 with a key later revealed is no longer any secure, because of the ease with which MD5 collisions can now be found. There's however no compelling ...
user avatar
  • 122k
11 votes
Accepted

Why is Fernet only AES-128-CBC?

This seems to me to be less secure... Do you have a plausible adversary that can break AES-128? AES-128 is believed (to the best of knowledge) to require $O(2^{...
user avatar
  • 131k
11 votes
Accepted

Which MAC to choose?

As a MAC, HMAC is fine, with any of the SHA-* functions. It's even fine with MD5, even though MD5, as a hash function, is quite broken. One interesting characteristic of HMAC is that it requires no ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible