Hot answers tagged

54 votes
Accepted

Ciphertext and tag size and IV transmission with AES in GCM mode

I'll answer in order: Output size = input size That's correct, GCM uses CTR internally. It encrypts a counter value for each block, but it only uses as many bits as required from the last block. CTR ...
user avatar
  • 85.1k
46 votes

Should we MAC-then-encrypt or encrypt-then-MAC?

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. ...
user avatar
40 votes

Why is SHA-3 robust against Length-Extension Attacks?

Everything was changed between SHA-2 and SHA-3. In the specific case of the "length extension attack": the issue is that SHA-2 process data by splitting it into elementary blocks (64 or 128 bytes, ...
user avatar
36 votes
Accepted

Why is plain-hash-then-encrypt not a secure MAC?

$\operatorname{Encrypt}(m\|H(m))$ is not an operating mode providing authentication; forgeries are possible in some very real scenarios. Depending on the encryption used, that can be assuming only ...
user avatar
  • 124k
32 votes
Accepted

AES-GCM recommended IV size: Why 12 bytes?

From the proposal of GCM (rewritten if statement): if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else $Y_0 = \operatorname{GHASH}(H, \{\}, IV)$. So there are additional ...
user avatar
  • 85.1k
29 votes
Accepted

Use cases for CMAC vs. HMAC?

HMAC was there first (the RFC 2104 is from 1997, while CMAC is from 2006), which is reason enough to explain its primacy. If you use HMAC, you will more easily find test vectors and implementations ...
user avatar
27 votes
Accepted

Is HMAC needed for a SHA-3 based MAC?

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC? No, you don't need to do ...
user avatar
  • 31.3k
23 votes

What happened to Poly1305AES? Is it obsolete?

Poly1305 is a universal hash function. The output of that function cannot be used safely without being encrypted. In order to encrypt it, any cipher can be used. AES was used as an example in the ...
user avatar
  • 2,764
21 votes
Accepted

Can Skein be used as a secure MAC in format H(k || m)?

Length extension attack The reason why $H(k \mathbin\| m)$ is insecure with most older hashes is that they use the Merkle–Damgård construction which suffers from length extensions. When length ...
user avatar
21 votes
Accepted

Can any MAC be used as a KDF?

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC ...
user avatar
20 votes

Why does HMAC use two different keys?

Alas, there is no simple satisfactory answer to this question. What I can offer is a very strong property that $m \mapsto H\bigl(k \mathbin\| H(k \mathbin\| m)\bigr)$ fails to achieve; a more ...
user avatar
18 votes
Accepted

Authentication using AES

TL;DR No, the approach is not secure. Use a standard like CMAC instead. Or even better, check your AES accelerator module to see if it supports any AEAD modes of encryption like GCM, CCM, EAX. Long ...
user avatar
  • 37.7k
18 votes

What is the advantage of digital signatures over message authentication codes?

If this requires a single answer among 1/2/3/4 (rather than none), I would select 3, by the following reasoning: Digital Signature provides confidentiality while message authentication code can ...
user avatar
  • 124k
17 votes

Is Encrypt(m||k2, k1) secure authenticated encryption?

Would it not be easier simply to send $E(m||s,k)$ where s is a salt shared across the system? Yes, that would be simpler; however, that would not (in general) be secure. The assumption you are ...
user avatar
  • 132k
16 votes

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Using $H(m\mathbin\Vert k)$ with hash function $H$, message $m$ and key $k$, is one possible way to build a MAC algorithm. It is not necessarily a good one; it depends on the used hash function. Even ...
user avatar
15 votes
Accepted

Why would Carter-Wegman-style message authentication not be broken by P = NP?

While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth. What they are talking about is a Carter-Wegman authentication method that uses a stream of random bits as ...
user avatar
  • 132k
14 votes
Accepted

How is HMAC(message,key) more secure than Hash(key1+message+key2)

The construction you are proposing is called the "envelope" or "sandwich" MAC, it predates HMAC, and it is in fact secure—provided the key and message are appropriately padded. That is, $$ \text{...
user avatar
  • 11.7k
14 votes
Accepted

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security ...
user avatar
  • 43.4k
13 votes
Accepted

Cryptographically secure keyed rolling hash function

One simple cryptographically secure rolling hash function is the following: $$F_{k1,k2}(x) = E_{k1}(R_{k2}(x))$$ where $R_{k2}(\cdot)$ is a non-cryptographic rolling hash function (e.g., Rabin-Karp),...
user avatar
  • 35.3k
13 votes

Why is Poly1305 popular given its 'sudden death' properties?

At least in the case of NaCl, Poly1305's "sudden death" properties aren't much worse than XSalsa20's. With any stream cipher, if you reuse the same stream with two messages, then the XOR of the ...
user avatar
13 votes

Authenticating a message with HMAC vs AES-CBC

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether ...
user avatar
  • 132k
13 votes

Is Poly1305 an information-theoretically secure MAC?

Can the $AES_k(n)$ portion be simply replaced with $k \oplus n$? No, but you're close, it would be replaced with $k + n$, where $+$ is addition modulo $2^{128}$; then it becomes informational ...
user avatar
  • 132k
13 votes
Accepted

The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
user avatar
13 votes

What happened to Poly1305AES? Is it obsolete?

What are those existing constructions? Usually people consider three to four scenarios for authenticated encryption for embedded environments: Constrained for ROM + RAM In this case you probably ...
user avatar
  • 44.6k
12 votes
Accepted

Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
user avatar
  • 85.1k
12 votes
Accepted

Should the identity of a sender be verified using additional means, or does a MAC suffice?

It is a recurring topic: what exactly is identity and how to prove it ? But related to your question: a MAC (correctly implemented) proves that the author of the message was in possession of the ...
user avatar
  • 372
12 votes
Accepted

Can keyed CRC be used as a MAC?

Trivial forgery: If you know the CRC polynomial, then you can add (‘xor’) any multiple of it to the message without changing the CRC. Short answer. If the hardware can only evaluate CRCs with fixed ...
user avatar
12 votes
Accepted

How many codes can I safely generate using the same HMAC key?

I don't think there is any official limitations when it comes from standardization bodies such as NIST. However, there do seem to be some papers such as New Generic Attacks Against Hash-based MACs. ...
user avatar
  • 85.1k
11 votes

Why is plain-hash-then-encrypt not a secure MAC?

Two things going on that together may make plain-hash-then-encrypt insecure. First, the distinction between secure MACs and hashes, which is that a hash function may allow you to derive $H(m')$ from $...
user avatar
  • 31.3k
11 votes
Accepted

Definition of "pepper" in hash functions

My understanding of the term 'pepper' is that it more matches your definition 2, in that a pepper is an unknown salt, which makes it a cryptographic secret, but not a key. However, in use it is not as ...
user avatar
  • 12.7k

Only top scored, non community-wiki answers of a minimum length are eligible