Tagged Questions
4
votes
1answer
48 views
How do I build a secure signing mechanism on top of HMAC
Say we have a system with strong shared keys (not passphrases), and we're trying to sign messages sent by the server that will be visible to an attacker. E.g. storing session state in a signed cookie.
...
3
votes
2answers
154 views
Reusing HMAC state for multiple messages
I have a secret key k and message m. I send m || HMAC(m, k) to some other party, who can verify the integrity of m, assuming that they know k.
Suppose I have multiple messages m1, m2, and so on. ...
