# Tag Info

1

The collision resistance of this hash will be the collision resistance of $\operatorname{HMAC-SHA256}_{IV}(M)$. Beware of the fact that pre-hashing of the key is a thing with HMAC, so $$\operatorname{HMAC-SHA256}_{\text{ReallyLongIV}}(M)=\operatorname{HMAC-SHA256}_{\operatorname{SHA256}(\text{ReallyLongIV})}(M)$$ Do I still need to include file length in ...

1

Yes this is "OK". Please correct me if I'm wrong there. You are correct. It's effectively ratcheting the original key. However there may be a more elegant solution such as using static keys for auth and ephemeral keys for key agreement (i.e. use Ephemeral-Ephemeral Diffie-Hellman for each new message).

2

The tag is to best I can tell, a tag. It's not really a signature, it's not a hash, it's pretty close to a mac. Is tag in this case colloquially synonymous with anything else? It is not just close to a MAC—it is a MAC. Various synonyms: message authentication code / MAC MAC tag authenticator authenticator tag authentication tag Is it right to say ...

0

Let's say you're talking about HMAC-SHA256, which is about the only reasonable use of HMAC other than HMAC-SHA512 these days. (For BLAKE2 or SHA-3, you don't need HMAC in the first place; there are native keyed versions.) How is HMAC-SHA256 different from AES-GMAC? (AES-GMAC is AES-GCM with an empty plaintext—the use case you're asking about, giving just ...

1

If I need to support AEAD sometimes, is it reasonable to just use AEAD all the time and skip HMAC entirely? Yes, and if you only need integrity / authenticity of the message then you can put all of the message in the Associated Data. HMAC should be faster, but how much? I’ll need to test this, but suspect the difference might not be huge. It won't be ...

1

The answer depends on how you define ‘convergent encryption’ and what threats you're hoping to defend against. Here are two broad options that you might mean: You're a storage service and you make lofty promises about encryption to your users, but you also do deduplication between unrelated parties. (Maybe you abuse the term ‘zero-knowledge’; it's trendy ...

Top 50 recent answers are included