Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
42 votes

What size should the HMAC key be with SHA-256?

Short answer: 32 bytes of full-entropy key is enough. Assuming full-entropy key (that is, each bit of key is chosen independently of the others by an equivalent of fair coin toss), the security of ...
fgrieu's user avatar
  • 142k
20 votes

Why does HMAC use two different keys?

Alas, there is no simple satisfactory answer to this question. What I can offer is a very strong property that $m \mapsto H\bigl(k \mathbin\| H(k \mathbin\| m)\bigr)$ fails to achieve; a more ...
Squeamish Ossifrage's user avatar
18 votes

Why not authenticate full-disk encryption?

Authentication and probabilistic encryption are two desirable features which each take up a small amount of extra space. And you are absolutely right that the percentage of space consumed is of no ...
kasperd's user avatar
  • 1,387
16 votes
Accepted

HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Both algorithms provide plenty of security, near the output size of the hash. So even though HMAC-512 will be stronger, the difference is inconsequential. If this ever breaks it is because the ...
Maarten Bodewes's user avatar
14 votes

Why not authenticate full-disk encryption?

So, are there reasons for not using authentication that I'm missing? I believe that the real reason is not actually space, but time. As you said, storing the tags would not require that much space. ...
poncho's user avatar
  • 148k
14 votes

What's the difference between PBKDF2 and HMAC-SHA256 in security?

HMAC is still very efficient. It's used in PBKDF2 not for the lower efficiency (that's handled by iterating it many times) because of the fact that it takes two inputs. That lets the password and ...
SAI Peregrinus's user avatar
13 votes

Authenticating a message with HMAC vs AES-CBC

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether ...
poncho's user avatar
  • 148k
13 votes
Accepted

Why not authenticate full-disk encryption?

With 4096-byte sectors, space is a complete non-issue, less than 1 % Problem 1: 10GB per TB is not a "complete non-issue" for many people. Problem 2: If the checksums are inside of their data ...
deviantfan's user avatar
  • 1,187
13 votes
Accepted

The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
Squeamish Ossifrage's user avatar
13 votes
Accepted

How many trials does it take to break HMAC-MD5?

You can find a collision in MD5 at much lower cost than $2^{64}$ evaluations of MD5. You could do the same for HMAC-MD5, if you knew the key, which renders it unfit for unusual applications such as ...
Squeamish Ossifrage's user avatar
13 votes
Accepted

Would a HMAC digest make sense in an RSA / ECDSA signature?

If we view HMAC as a message authentication code or a PRF, this doesn't quite make sense: the security property for a MAC or a PRF assumes that the forger doesn't know the key, but you've given them ...
Squeamish Ossifrage's user avatar
12 votes
Accepted

How many codes can I safely generate using the same HMAC key?

I don't think there is any official limitations when it comes from standardization bodies such as NIST. However, there do seem to be some papers such as New Generic Attacks Against Hash-based MACs. ...
Maarten Bodewes's user avatar
11 votes

Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
Maarten Bodewes's user avatar
11 votes
Accepted

Why is Fernet only AES-128-CBC?

This seems to me to be less secure... Do you have a plausible adversary that can break AES-128? AES-128 is believed (to the best of knowledge) to require $O(2^{...
poncho's user avatar
  • 148k
11 votes
Accepted

Which MAC to choose?

As a MAC, HMAC is fine, with any of the SHA-* functions. It's even fine with MD5, even though MD5, as a hash function, is quite broken. One interesting characteristic of HMAC is that it requires no ...
Thomas Pornin's user avatar
10 votes

HMAC with public-private key

Consider the following system involving a message authentication code like HMAC-SHA256: Alice generates a key and shares it with Bob, and Bob alone. Alice authenticates a message with the key. Bob ...
Squeamish Ossifrage's user avatar
10 votes
Accepted

Choosing between simple Hash and HKDF to derive the second key used for MAC

The HKDF paper answers this question at length. Section 8 in particular seems to be the most relevant. But perhaps you may find that the explanations are very technical. To help you out a little ...
Luis Casillas's user avatar
10 votes
Accepted

Signing dynamic data on an embedded system

Signature algorithms of the ECDSA family are amenable to precomputations. Indeed, when you want to sign message m with ECDSA, the process goes thus: We work in a curve (or a subgroup of a curve) of ...
Thomas Pornin's user avatar
10 votes
Accepted

Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

See chapter 5.11.2 of the paper “Cryptographic sponge functions” (the link can be found here): Note that one can also define a MAC function by taking as input the message followed by the key: $...
lyrically wicked's user avatar
10 votes
Accepted

When do I need to use CBC and HMAC?

Also, there is CBC-MAC for providing integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC? Which one is "better" is opinionated, but we can argue which objective ...
Maarten Bodewes's user avatar
10 votes

Could a 6502 CPU safely compute a SHA-1 hash in a reasonable length of time?

Yes, a 6502 can compute SHA-1 in a reasonable time: less than $\lceil(k+9)/64\rceil/5$ second for a $k$-byte message on a 1 MHz 6502 as on the 1977 Apple ][. E.g. 0.2s for up to 55 bytes. We need like ...
fgrieu's user avatar
  • 142k
10 votes
Accepted

Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?

In 2006, Mihir Bellare, in their article New Proofs for NMAC and HMAC: Security without Collision-Resistance proved that if the compression function is a PRF then HMAC is a PRF ( this is a short ...
kelalaka's user avatar
  • 48.7k
9 votes
Accepted

Can I use a HMAC for Replay Attack protection?

An old but excellent paper on this topic is Tuomas Aura's Strategies against Replay Attacks. The simplest version of the "Hashed Full Information" method would be to include the MAC of the ...
joveian's user avatar
  • 345
9 votes
Accepted

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that; This paper is not very clear and has led many people into regrettable confusion about universal hashing authenticators. The paper—both the ...
Squeamish Ossifrage's user avatar
9 votes
Accepted

How is it possible that these two encryption functions yield the same result?

This is a problem created by the library. Either the HMAC algorithm is skipped entirely, or - more likely - the HMAC authentication tag is generated and then forgotten. The reason is likely the spotty ...
Maarten Bodewes's user avatar
8 votes
Accepted

HMAC Secure Key Exchange?

How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute keys? The answers to those questions are beyond the scope of the RFC. ...
mikeazo's user avatar
  • 38.6k
8 votes
Accepted

Should HMAC-SHA3 be preferred over H(C(k,M))?

HMAC does not provide an obvious security improvement over the KMAC construction, which is optimal for Keccak based functions. HMAC is designed to create a secret initialization vector or IV for ...
Richie Frame's user avatar
  • 13.1k
8 votes
Accepted

Is HMAC prone to birthday attacks?

Is the same true for HMAC ? Yes, HMAC outputs are hashes of something so after $2^{n/2}$ you expect two to match. However, this alone does not help the attacker. The attacker cannot compute the MAC ...
otus's user avatar
  • 32.1k
8 votes
Accepted

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

As the comment you quote notes: On some platforms, including Intel, the [modulo] operation can take a smaller number of cycles if the input is "small". Is that really true, and what does that mean?...
Ilmari Karonen's user avatar
8 votes
Accepted

Replay attack prevention in connectionless UDP encrypted communication

The simplest way to deal with replay attack prevention (in some narrow sense of that, where the goal is to avoid that the receiver allows the same command to be played to it several times) is to have ...
fgrieu's user avatar
  • 142k

Only top scored, non community-wiki answers of a minimum length are eligible