Tag Info

Accepted

Ciphertext and tag size and IV transmission with AES in GCM mode

I'll answer in order: Output size = input size That's correct, GCM uses CTR internally. It encrypts a counter value for each block, but it only uses as many bits as required from the last block. CTR ...
• 85.1k

Should we MAC-then-encrypt or encrypt-then-MAC?

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. ...
• 26.9k

Why is SHA-3 robust against Length-Extension Attacks?

Everything was changed between SHA-2 and SHA-3. In the specific case of the "length extension attack": the issue is that SHA-2 process data by splitting it into elementary blocks (64 or 128 bytes, ...
• 84.6k
Accepted

Why is plain-hash-then-encrypt not a secure MAC?

$\operatorname{Encrypt}(m\|H(m))$ is not an operating mode providing authentication; forgeries are possible in some very real scenarios. Depending on the encryption used, that can be assuming only ...
• 124k
Accepted

AES-GCM recommended IV size: Why 12 bytes?

From the proposal of GCM (rewritten if statement): if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else $Y_0 = \operatorname{GHASH}(H, \{\}, IV)$. So there are additional ...
• 85.1k
Accepted

Use cases for CMAC vs. HMAC?

HMAC was there first (the RFC 2104 is from 1997, while CMAC is from 2006), which is reason enough to explain its primacy. If you use HMAC, you will more easily find test vectors and implementations ...
• 84.6k
Accepted

Is HMAC needed for a SHA-3 based MAC?

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC? No, you don't need to do ...
• 31.3k

What happened to Poly1305AES? Is it obsolete?

Poly1305 is a universal hash function. The output of that function cannot be used safely without being encrypted. In order to encrypt it, any cipher can be used. AES was used as an example in the ...
• 2,764
Accepted

Can Skein be used as a secure MAC in format H(k || m)?

Length extension attack The reason why $H(k \mathbin\| m)$ is insecure with most older hashes is that they use the Merkle–Damgård construction which suffers from length extensions. When length ...
• 24k
Accepted

Can any MAC be used as a KDF?

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC ...
• 26.9k

Why does HMAC use two different keys?

Alas, there is no simple satisfactory answer to this question. What I can offer is a very strong property that $m \mapsto H\bigl(k \mathbin\| H(k \mathbin\| m)\bigr)$ fails to achieve; a more ...
• 45.8k
Accepted

Authentication using AES

TL;DR No, the approach is not secure. Use a standard like CMAC instead. Or even better, check your AES accelerator module to see if it supports any AEAD modes of encryption like GCM, CCM, EAX. Long ...
• 37.7k

What is the advantage of digital signatures over message authentication codes?

If this requires a single answer among 1/2/3/4 (rather than none), I would select 3, by the following reasoning: Digital Signature provides confidentiality while message authentication code can ...
• 124k

Is Encrypt(m||k2, k1) secure authenticated encryption?

Would it not be easier simply to send $E(m||s,k)$ where s is a salt shared across the system? Yes, that would be simpler; however, that would not (in general) be secure. The assumption you are ...
• 132k

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Using $H(m\mathbin\Vert k)$ with hash function $H$, message $m$ and key $k$, is one possible way to build a MAC algorithm. It is not necessarily a good one; it depends on the used hash function. Even ...
• 84.6k
Accepted

Why would Carter-Wegman-style message authentication not be broken by P = NP?

While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth. What they are talking about is a Carter-Wegman authentication method that uses a stream of random bits as ...
• 132k
Accepted

• 35.3k

Why is Poly1305 popular given its 'sudden death' properties?

At least in the case of NaCl, Poly1305's "sudden death" properties aren't much worse than XSalsa20's. With any stream cipher, if you reuse the same stream with two messages, then the XOR of the ...

Authenticating a message with HMAC vs AES-CBC

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether ...
• 132k

Is Poly1305 an information-theoretically secure MAC?

Can the $AES_k(n)$ portion be simply replaced with $k \oplus n$? No, but you're close, it would be replaced with $k + n$, where $+$ is addition modulo $2^{128}$; then it becomes informational ...
• 132k
Accepted

The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
• 45.8k

What happened to Poly1305AES? Is it obsolete?

What are those existing constructions? Usually people consider three to four scenarios for authenticated encryption for embedded environments: Constrained for ROM + RAM In this case you probably ...
• 44.6k
Accepted

Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
• 85.1k
Accepted

Should the identity of a sender be verified using additional means, or does a MAC suffice?

It is a recurring topic: what exactly is identity and how to prove it ? But related to your question: a MAC (correctly implemented) proves that the author of the message was in possession of the ...
• 372
Accepted

Can keyed CRC be used as a MAC?

Trivial forgery: If you know the CRC polynomial, then you can add (‘xor’) any multiple of it to the message without changing the CRC. Short answer. If the hardware can only evaluate CRCs with fixed ...
• 45.8k
Accepted

How many codes can I safely generate using the same HMAC key?

I don't think there is any official limitations when it comes from standardization bodies such as NIST. However, there do seem to be some papers such as New Generic Attacks Against Hash-based MACs. ...
• 85.1k

Why is plain-hash-then-encrypt not a secure MAC?

Two things going on that together may make plain-hash-then-encrypt insecure. First, the distinction between secure MACs and hashes, which is that a hash function may allow you to derive $H(m')$ from \$...
• 31.3k