Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
41 votes

Why is SHA-3 robust against Length-Extension Attacks?

Everything was changed between SHA-2 and SHA-3. In the specific case of the "length extension attack": the issue is that SHA-2 process data by splitting it into elementary blocks (64 or 128 bytes, ...
Thomas Pornin's user avatar
35 votes
Accepted

AES-GCM recommended IV size: Why 12 bytes?

From the proposal of GCM (rewritten if statement): if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else $Y_0 = \operatorname{GHASH}(H, \{\}, IV)$. So there are additional ...
Maarten Bodewes's user avatar
24 votes

What happened to Poly1305AES? Is it obsolete?

Poly1305 is a universal hash function. The output of that function cannot be used safely without being encrypted. In order to encrypt it, any cipher can be used. AES was used as an example in the ...
Frank Denis's user avatar
  • 2,973
21 votes
Accepted

Can any MAC be used as a KDF?

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC ...
Yehuda Lindell's user avatar
20 votes

Why does HMAC use two different keys?

Alas, there is no simple satisfactory answer to this question. What I can offer is a very strong property that $m \mapsto H\bigl(k \mathbin\| H(k \mathbin\| m)\bigr)$ fails to achieve; a more ...
Squeamish Ossifrage's user avatar
18 votes

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Using $H(m\mathbin\Vert k)$ with hash function $H$, message $m$ and key $k$, is one possible way to build a MAC algorithm. It is not necessarily a good one; it depends on the used hash function. Even ...
Thomas Pornin's user avatar
17 votes

Is Encrypt(m||k2, k1) secure authenticated encryption?

Would it not be easier simply to send $E(m||s,k)$ where s is a salt shared across the system? Yes, that would be simpler; however, that would not (in general) be secure. The assumption you are ...
poncho's user avatar
  • 148k
17 votes
Accepted

Does the order of validations and MAC with clear text matter?

I'd always first verify the MAC. It makes more sense protocol-wise, as you are just left with the plaintext values after performing the cryptographic operations. Maybe you want to use a container ...
Maarten Bodewes's user avatar
16 votes
Accepted

Relationship between PRF/KDF/MAC?

A key derivation function (KDF) takes in some secret keying material, which may or may not be uniformly distributed, and where the adversary may also have some auxiliary information about the keying ...
hakoja's user avatar
  • 2,725
16 votes
Accepted

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security ...
kelalaka's user avatar
  • 48.7k
15 votes
Accepted

Why would Carter-Wegman-style message authentication not be broken by P = NP?

While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth. What they are talking about is a Carter-Wegman authentication method that uses a stream of random bits as ...
poncho's user avatar
  • 148k
15 votes
Accepted

Is constant-time compare really required for AEAD ciphers?

Let the vulnerable comparison compare byte-by-byte and break out of the loop after the first mismatch. If we neglect noise, this leaks how many bytes (prefix) of the MAC are correct via timing. Then ...
CodesInChaos's user avatar
  • 24.9k
13 votes
Accepted

Why MACs are so important despite digital signatures doing everything a MAC can do and more?

There are many advantages of MACs over signatures. For signatures, you need to use asymmetric key pairs. Public keys need to be trusted for this to work. Unfortunately, establishing trust is not that ...
Maarten Bodewes's user avatar
13 votes

Why MACs are so important despite digital signatures doing everything a MAC can do and more?

MACs have some advantages over digital signatures The component of the computational cost that is independent of message size is much higher for digital signatures, to the point of being an obstacle ...
fgrieu's user avatar
  • 142k
13 votes

Authenticating a message with HMAC vs AES-CBC

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether ...
poncho's user avatar
  • 148k
13 votes

AES-GCM recommended IV size: Why 12 bytes?

In the general case, the security goal is to reduce the probability that the internal 128-bit counter block ever takes the same value when instantiating the GCM cipher with a given key. That is ...
SquareRootOfTwentyThree's user avatar
13 votes

Is Poly1305 an information-theoretically secure MAC?

Can the $AES_k(n)$ portion be simply replaced with $k \oplus n$? No, but you're close, it would be replaced with $k + n$, where $+$ is addition modulo $2^{128}$; then it becomes informational ...
poncho's user avatar
  • 148k
13 votes
Accepted

The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
Squeamish Ossifrage's user avatar
13 votes

What happened to Poly1305AES? Is it obsolete?

What are those existing constructions? Usually people consider three to four scenarios for authenticated encryption for embedded environments: Constrained for ROM + RAM In this case you probably ...
SEJPM's user avatar
  • 46.1k
12 votes
Accepted

Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
Maarten Bodewes's user avatar
12 votes
Accepted

Is a secure deterministic MAC always a PRF?

Your intuition is not right. The fact that no forger can obtain new valid message/tag pairs doesn't say anything about the "shape" of the MAC. For instance, if $\Pi$ is a secure MAC, then the MAC ...
Daniel's user avatar
  • 3,972
12 votes
Accepted

Should the identity of a sender be verified using additional means, or does a MAC suffice?

It is a recurring topic: what exactly is identity and how to prove it ? But related to your question: a MAC (correctly implemented) proves that the author of the message was in possession of the ...
entrop-x's user avatar
  • 372
12 votes
Accepted

Can keyed CRC be used as a MAC?

Trivial forgery: If you know the CRC polynomial, then you can add (‘xor’) any multiple of it to the message without changing the CRC. Short answer. If the hardware can only evaluate CRCs with fixed ...
Squeamish Ossifrage's user avatar
12 votes
Accepted

How many codes can I safely generate using the same HMAC key?

I don't think there is any official limitations when it comes from standardization bodies such as NIST. However, there do seem to be some papers such as New Generic Attacks Against Hash-based MACs. ...
Maarten Bodewes's user avatar
12 votes

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

how can we prevent the cipher from being returned in case the tag is wrong ? As far as I understand, to compute the tag the decryption process must be done entirely. Actually, GCM decryption can be ...
poncho's user avatar
  • 148k
11 votes

Is HMAC needed for a SHA-3 based MAC?

KMAC has now been specified in NIST SP 800-185, chapter 4. It is based on cSHAKE128 and cSHAKE256, which both are based on the same Keccak sponge that SHA-3 is. It doesn't use any additional methods ...
Maarten Bodewes's user avatar
11 votes
Accepted

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? For the previous question I'll quote Matthew Green's post from 2013: A quick reminder. CBC-MAC is very similar to the ...
ddddavidee's user avatar
  • 3,334
11 votes
Accepted

Which MAC to choose?

As a MAC, HMAC is fine, with any of the SHA-* functions. It's even fine with MD5, even though MD5, as a hash function, is quite broken. One interesting characteristic of HMAC is that it requires no ...
Thomas Pornin's user avatar
9 votes
Accepted

Do I need to use a MAC with asymmetric encryption?

Yes, (asymmetric) encrypt-then-sign would provide the same properties as (symmetric) encrypt-then-mac. It would provide integrity and authenticity of the ciphertext. It is however possible for another ...
Maarten Bodewes's user avatar
9 votes
Accepted

Can I use a HMAC for Replay Attack protection?

An old but excellent paper on this topic is Tuomas Aura's Strategies against Replay Attacks. The simplest version of the "Hashed Full Information" method would be to include the MAC of the ...
joveian's user avatar
  • 345

Only top scored, non community-wiki answers of a minimum length are eligible