5
Is there an efficient way to do this?
32 bytes of "good randomness" provided by hashing some secret value gives much less entropy than required to directly compute a sample of 100 items from a list of 100000. If this is required for any cryptographic purpose, you must use a good CSPRNG to convert your starting entropy into as much randomness as ...
2
Indeed FIPS 140-2 requires a module to validate itself, and this has no security benefit.
In order for a code integrity check to have a security benefit, both the code that performs the verification and the data that it uses (hash value for a hash, MAC value and secret key for a MAC, public key for a signature) need to be integrity-protected (and with a MAC, ...
answered Jul 15 at 16:29
Gilles 'SO- stop being evil'
12.8k3 gold badges35 silver badges67 bronze badges
1
You can just use a hash tree with a pre-configured node size then only the last hash value would be vulnerable to a length extension attack. In that sense this is not that different from performing a HMAC over a single hash.
However, that's kind of besides the point. A length extension attack is only applicable for keyed hashes. As the hashes are not keyed ...
1
If I understand correctly, your input to HMAC is the ciphertext $c$, padded with null bytes (to a multiple of 16 bytes):
# pad to a multiple of 16 bytes
if self._len_ct & 0x0F:
self._auth.update(bytes(16 - (self._len_ct & 0x0F)))
As a concrete example, suppose the ciphertext is $c=$ deadbeef00, then you will compute the HMAC tag as $t ...
Only top voted, non community-wiki answers of a minimum length are eligible
