New answers tagged

0

Lastly, a 32-byte HMAC value of the ciphertext is created using the HMAC key and SHA-256 and written as the last two blocks of the ciphertext (32 bytes). You really should include the IV in the calculation. Otherwise the authentication tag validates, and with a wrong IV it will still result in invalid plaintext. This is less of an issue with the salt, as a ...


0

In this case, this answer also should be a comment (I'm sorry!). @Hunter, the NIST SP 800-108 define the use of hmac as PRF. For example, in python, you can use: hash_algo = hashes.SHA512() kdf = KBKDFHMAC(algorithm=hash_algo, mode=Mode.CounterMode, length=32, rlen=4, llen=4, location=CounterLocation.BeforeFixed, label=label, context=context, fixed=None, ...


0

I recommend HKDF - it's a key-based key derivation function (as opposed to password-based). It accepts an already-high entropy input (your AES key), a salt (you could use your "plain text"), and optional info, for contextualizing the key. It would be better to use your main key to derive two separate keys, one for encryption, and one for HMAC... ...


2

In general, we always assume that the mode of operation is known ahead of time. In practice, this should be bound to the key - if the key is only used for a single mode of operation then the above shouldn't happen. However, if the same key is used for multiple modes of operation, then the mode ID should be made part of the ciphertext and therefore included ...


Top 50 recent answers are included