2022 Developer Survey is open! Take survey.

Hot answers tagged

5 votes
Accepted

Is KMAC just SHA-3-256(KEY || message)

Standard KMAC is more than that thanks to domain separation prefixes; NIST SP 800-185 KMAC128(K, X, L, S): Validity Conditions: $\text{len}(K) < 2^{2040}$ and $0 \le L < 2^{2040}$ and $\text{...
user avatar
  • 43.1k
4 votes

Should I use HMAC or KMAC for SHA3?

The prefix-PRF function $F_k\colon m \mapsto H(k \mathbin\| m)$ is conjectured to be a pseudorandom function family—and therefore a good MAC—under the key $k$ when $H$ is any of the fixed SHA-3 ...
user avatar
4 votes

Should I use HMAC or KMAC for SHA3?

So if I want to implement a MAC function Can i just do the first method ?? just pad the message with key and do the hash ? Yes, $mac = \text{SHA3}(k||m)$ is a secure MAC if $k$ is a fixed-length key. ...
user avatar
3 votes
Accepted

Recommended Shake256 digest size for KMAC based HKDF

HKDF already has expansion on top of the MAC that it is based on. What would be the point of using a XOF for that? Why not use the XOF directly or define a different KDF? Because having two different ...
user avatar
  • 84.7k
2 votes
Accepted

Can you use a dynamic key and data size for KMAC?

Yes, however it does take a deeper look into the standard. KMAC128 is defined as: newX = bytepad(encode_string(K), 168) || X || right_encode(L). ...
user avatar
  • 84.7k
1 vote

Equivalent security of KMAC and different HMAC instances?

Yep, this is confusing indeed! I think you're misreading SP 800-107. If we go back a little bit from the part you refer to, to section 5.3.1, we have this (p. 13): The security strength provided ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible