# Tag Info

Accepted

### HMAC vs ECDSA for JWT

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
• 139k
Accepted

### Key size for HMAC-SHA256

Short answer: 32 bytes of full-entropy key is enough. Assuming full-entropy key (that is, each bit of key is chosen independently of the others by an equivalent of fair coin toss), the security of ...
• 132k
Accepted

### Why is HMAC-SHA1 still considered secure?

In the first section of this answer I'll assume that through better hardware or/and algorithmic improvements, it has become routinely feasible to exhibit a collision for SHA-1 by a method similar to ...
• 132k

### HMAC-SHA1 vs HMAC-SHA256

I would use HMAC-SHA256. While poncho's answer that both are secure is reasonable, there are several reasons I would prefer to use SHA-256 as the hash: Attacks only get better. SHA-1 collision ...
• 31.8k
Accepted

### Encrypt-then-MAC: Do I need to authenticate the IV?

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples. In CTR mode, an attacker who fiddles with the IV ...
• 11.9k

### What size should the HMAC key be with SHA-256?

The only rule for the key is that it should at least contain 256 bits of randomness. If the key is smaller you may not get the full security of HMAC-SHA-256. The full security of HMAC is basically ...
• 89.2k

### Why does HMAC use two different keys?

Alas, there is no simple satisfactory answer to this question. What I can offer is a very strong property that $m \mapsto H\bigl(k \mathbin\| H(k \mathbin\| m)\bigr)$ fails to achieve; a more ...

• 12.1k

### Why not authenticate full-disk encryption?

So, are there reasons for not using authentication that I'm missing? I believe that the real reason is not actually space, but time. As you said, storing the tags would not require that much space. ...
• 139k

### What's the difference between PBKDF2 and HMAC-SHA256 in security?

HMAC is still very efficient. It's used in PBKDF2 not for the lower efficiency (that's handled by iterating it many times) because of the fact that it takes two inputs. That lets the password and ...
• 5,496

### Authenticating a message with HMAC vs AES-CBC

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether ...
• 139k
Accepted

### Why not authenticate full-disk encryption?

With 4096-byte sectors, space is a complete non-issue, less than 1 % Problem 1: 10GB per TB is not a "complete non-issue" for many people. Problem 2: If the checksums are inside of their data ...
• 1,187
Accepted

### The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
Accepted

### How many trials does it take to break HMAC-MD5?

You can find a collision in MD5 at much lower cost than $2^{64}$ evaluations of MD5. You could do the same for HMAC-MD5, if you knew the key, which renders it unfit for unusual applications such as ...
Accepted

### Keys in HMAC and NMAC

NMAC is really just an "education tool" on the way to HMAC and I don't think anyone intended it to be used. The two keys are needed since the first and second hashes have different purposes. The first ...
• 27.3k
Accepted

### Is there a null HMAC?

It is well defined. The hash function has no impact on whether HMAC is defined for a null string text argument. As long as HMAC is defined for a particular hash function, the resulting HMAC of a null ...
• 10.3k
Accepted

### How many codes can I safely generate using the same HMAC key?

I don't think there is any official limitations when it comes from standardization bodies such as NIST. However, there do seem to be some papers such as New Generic Attacks Against Hash-based MACs. ...
• 89.2k

### Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
• 89.2k
Accepted

### Is HMAC-MD5 still secure for commitment or other common uses?

No, message commitment by disclosing its HMAC-MD5 with a key later revealed is no longer any secure, because of the ease with which MD5 collisions can now be found. There's however no compelling ...
• 132k
Accepted

### Why is Fernet only AES-128-CBC?

This seems to me to be less secure... Do you have a plausible adversary that can break AES-128? AES-128 is believed (to the best of knowledge) to require \$O(2^{...
• 139k
Accepted

### Which MAC to choose?

As a MAC, HMAC is fine, with any of the SHA-* functions. It's even fine with MD5, even though MD5, as a hash function, is quite broken. One interesting characteristic of HMAC is that it requires no ...
• 85.9k
Accepted

### Would a HMAC digest make sense in an RSA / ECDSA signature?

If we view HMAC as a message authentication code or a PRF, this doesn't quite make sense: the security property for a MAC or a PRF assumes that the forger doesn't know the key, but you've given them ...

### HMAC with public-private key

Consider the following system involving a message authentication code like HMAC-SHA256: Alice generates a key and shares it with Bob, and Bob alone. Alice authenticates a message with the key. Bob ...
Accepted

### Choosing between simple Hash and HKDF to derive the second key used for MAC

The HKDF paper answers this question at length. Section 8 in particular seems to be the most relevant. But perhaps you may find that the explanations are very technical. To help you out a little ...
• 14.3k