New answers tagged

5

Standard KMAC is more than that thanks to domain separation prefixes; NIST SP 800-185 KMAC128(K, X, L, S): Validity Conditions: $\text{len}(K) < 2^{2040}$ and $0 \le L < 2^{2040}$ and $\text{len}(S) < 2^{2040}$ newX = bytepad(encode_string(K), 168) || X || right_encode(L). return cSHAKE128(newX, L, “KMAC”, S). and cSHAKE128(X, L, N, S): ...


6

Consider $H$ defined as: SHA-512, with it's output XORed with the first 512 bits of the input message (padded with zeroes for short message). With such $H$, the proposed MAC is insecure. Yet, as far as we know, this $H$ is no worse than SHA-512 from a standard standpoint. Argument: observe that if $H(m_1\mathbin\|m_2)=\operatorname{SHA-512}(m_1\mathbin\|m_2)\...


2

Kerberos uses des-cbc-hmac (mac and encrypt) and rc4-hmac-exp based on md5 (mac and encrypt I think) in their encryptions. Those encryptions are considered as weak and should not be used. Why are they considered as weak? What attacks can be launched against those encryptions? Regarding the ciphers: DES is considered to be a weak block cipher because the ...


Top 50 recent answers are included