# Tag Info

8

No, the proposed construction is not secure, unless the block size $b$ of the block cipher is unusually large, or much wider than the MAC. Assuming $p$ known distinct message/MAC pairs $(m_i,h_i)$ with $b$-bit message $m_i$ and $h_i$ at least $b$-bit, there's a simple attack of expected cost dominated by $2^b/p$ hashes and searches among the $h_i$. The ...

7

In 2006, Mihir Bellare, in their article New Proofs for NMAC and HMAC: Security without Collision-Resistance proved that if the compression function is a PRF then HMAC is a PRF ( this is a short story, see below). As a result, HMAC like HMAC-MD5 does not suffer the weaknesses of MD5. However, still prefer HMAC-SHA256 or KMAC of the SHA-3 series. Keep ...

6

Yes, there is an important one; The Non-Reputation; Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract The HMAC key is a symmetric key therefore there is no non-repudiation. Both sides can not claim that the other side sends them the message $m$. I.e. They ...

5

The point (( also see this answer)) is that the hash calculation is free for everybody and we assume that your methodology is known by Kerckhoffs's principles. Anybody can calculate the hash of any information and this may leak the encrypted message. In Cryptography, we consider the attackers computationally bounded, but not restricted to adapt any method on ...

4

The answer given by @kelalaka is 100% correct; this breaks the security of encryption and so shouldn't be used. However, I want to add that this doesn't even guarantee integrity. In particular, integrity should hold even if the attacker knows the message. Assume that the attacker knows $m$ and wishes to change the first bit. This change can be easily made (...

4

You are describing encrypt-then-MAC using AES-CTR for encryption and HMAC for the MAC. This indeed results in authenticated encryption. There may be better choices for the key derivation function, but I'm not very familiar with the options, so I'll let others comment. I don't understand why you salt the KDF when deriving the key. This just means that you ...

3

If by "time based key", you mean the six- to eight-digit one-time password that the user enters, then no, compromising one of those does not compromise future passwords. That's because the one-time password is generated from an HMAC output with the shared secret as the key and the timestamp as the value. If an attacker could determine the shared ...

3

What's keeping a running transcript hash value ? It means keeping the internal state of the hash in-between processing pieces of the message hashed. Virtually all hashes are designed to make this easy, for the benefit of devices with limited RAM. They can hash large messages piece by piece, with a three-function interface Start/Hash/Finalize allowing to ...

3

If the MAC is theoretically secure, but its implementation has a side channel (like by Differential Power Analysis, maybe even timing) leaking information about the MACed message (but not the key), and the encryption is secure including it's implementation, then neither MtE nor MtEtM are safe (because the side channel leaks about the message), but EtM is ...

2

I'd confidently go for "first N bytes". It's quite universally recognized that the output of practical cryptographic hashes are bitstrings or bytestrings; where a bytestring starts is subject to little ambiguity; and how to count starting from that is unambiguous. That's not to say that an error is impossible. In particular, the MD5 output is 128 ...

2

What is the best hash for HMAC? The answer is: for the best interoperability, security, and efficiency, HMAC is best instantiated with SHA256 as HMAC-SHA256. Let me explain. History HMAC was first proposed in the paper "Keying Hash Functions for Message Authentication" by Mihir Bellare, Ran Canettiy, and Hugo Krawczyk in 1996, as a construction ...

2

In general, we always assume that the mode of operation is known ahead of time. In practice, this should be bound to the key - if the key is only used for a single mode of operation then the above shouldn't happen. However, if the same key is used for multiple modes of operation, then the mode ID should be made part of the ciphertext and therefore included ...

2

TLDR: (2) is a sufficient condition, but probably not a necessary condition. Most people would probably believe that HMAC-SHA-1 is indeed a PRF, although SHA-1 is not WCR. The 2006 paper by Bellare claims to prove that e.g. HMAC-SHA-1 is a PRF, if the inner compression function of SHA-1 is a PRF. No known attacks break the pseudorandomness of the inner ...

2

Linux uses "sha512crypt", which isn't memory-hard but is fine given a moderately strong input passphrase. HMAC-SHA256 isn't a password-hashing algorithm. It's not even a hash function. It requires a uniformly-random secret key which it uses on a message to produce a Message Authentication Code (tag) of that message under that key. The password-...

2

I had emailed Dr Thomas Pornin the very same question and received his reply. With his permission I cross post his answer as followed From: "Thomas Pornin" ... Date: 2021/04/22 11:38 Q1: Additional data k' is concatenated after bits2octets(H(m)) in HMAC input in step d. May we also need to concatenate k' after bits2octets(H(m)) in HMAC input in ...

2

The difference seems to be that cmacs are using a symmetric encryption additional to the hash-function while hmacs process the key within the hash-function itself. Is that correct? There is no "normal" collision-resistant hash involved with CMAC. See below for details. For HMAC, the internals of the hash function are exploited to process the key, ...

2

It depends on the algorithm. The Kerberos specification states that the encryption and decryption functions must handle integrity checking, but the algorithm specified must define this behavior. The only reasonably secure Kerberos algorithm types that Windows supports are aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96. Neither of these are great ...

2

No. The birthday paradox applies to all image spaces. Randomly evaluating any function with large input space and an image space of size $2^{n/2}$ is expected to produce a collision after roughly $2^{n/4}$ evaluations.

2

Is my understanding valid? It's close. I would put it this way: with CMAC, if you know the key and the CMAC output and know (have a guess) of the entire message except for a block (16 bytes for AES), it is easy to compute what that unknown block would have to be to make CMAC generate the observed output. This doesn't apply to HMAC; there, they only thing ...

2

If the nonce is known then HMAC is turned into a hash function, and an adversary can perform an active attack by simply replacing the authentication tag $t$ with $t' = H_{k=nonce}(ciphertext')$. If a large $N$ is known or not doesn't matter; if the nonce remains secret then $N$ is simply the domain from which the secret is taken; i.e. in that case you've ...

1

where does the auth data comes from? What the diagram labels “Auth Data” is additional authenticated data which is more commonly called “associated data” or “additional data” and abbreviated AAD or AD. It's an input of the GCM calculation. You don't generate it. GCM always takes AD input. It can be empty, there's nothing special about empty AD in the ...

1

all the hashing will do is introduce more randomness No. You cannot introduce randomness with a deterministic process. You can only introduce randomness with an actual source of random data. You can use a hash as a component of a pseudorandom generator, and a (cryptographically secure!) pseudorandom generator is good enough for cryptography where randomness ...

1

Whenever PBKDF2 is used as a KDF with a key of large entropy, it's iteration parameter can safely be 1, which should markedly improve the problem at hand with little work. That applies if the key is a password that has at least 128-bit entropy (e.g. 22 characters randomly selected among 64). If on the other hand the password is simple enough to be memorized, ...

1

A keyed hash is not susceptible to collisions / the birthday paradox as the attacker doesn't have the key; you cannot do any pre-calculation and create a set of known hashes because of that (well, you could if you'd have an Oracle with the key, but in that case the Oracle would be signing random data delivered to it). So you underestimate the security ...

1

The goal of a pepper is to protect passwords in the event that a database of password hashes is compromised but other parts of the authentication system are not compromised. Password hashing functions' output contains their input parameters, salt, and the digest, so obscuring it irretrievably via HMAC would make it impossible to verify a user's password. ...

1

Even though they have slightly different properties, both Poly1305 and HMAC take a key and a message, and return an authenticator. A nonce is not a parameter they have. The nonce is a parameter of the encryption and decryption functions. For a given key, different nonces are likely to generate different ciphertexts. And in an encrypt-then-MAC construction, ...

1

NIST SP 800-107, section 5.3.4 which reads Let C denote the bit length of the internal hash value that is denoted H in FIPS 180-4. (This H is often called the “chaining value” in descriptions of Merkle–Damgård-style hash functions.) Note that C is not (necessarily) equal to L, the bit length of the hash function’s output (see, for example, SHA-384 or SHA-...

1

For collision resistance, the bit security of a hash function is half the length of its output. This is because one can find a collision in any hash function of output length $n$ in time $2^{n/2}$. That is why the bit security of SHA256 with respect to its primary security property of collision resistance is 128. However, this doesn't mean that SHA256 cannot ...

1

Lastly, a 32-byte HMAC value of the ciphertext is created using the HMAC key and SHA-256 and written as the last two blocks of the ciphertext (32 bytes). You really should include the IV in the calculation. Otherwise the authentication tag validates, and with a wrong IV it will still result in invalid plaintext. This is less of an issue with the salt, as a ...

Only top voted, non community-wiki answers of a minimum length are eligible