a method for constructing a message authentication code based on a cryptographic hash function.

learn more… | top users | synonyms

2
votes
1answer
26 views

What is the ideal HMAC message format if message is an array?

I'm using HMAC exactly as intended to verify the integrity of a message. However, the message is really an associative array (or a hash). Since this will be done on various platforms (within and ...
2
votes
1answer
58 views

HMACs that have the same key and message

im using HMACSHA256 to generate the hash of password and store it. the objective here is to just authenticate users, i.e - save their hashed passwords, and validate users whenever needed using the ...
1
vote
2answers
54 views

Does using a MAC for encryption remove the need for PKCS7 padding with this class?

I am working with this PHP encryption class using MCRYPT_RIJNDAEL_256 and MCRYPT_MODE_CBC with a fixed 32-byte (64 character) HMAC key, as my basis. The class is a result of previous discussions and ...
3
votes
2answers
133 views

Securing a multi-tenant, multi-database REST API

I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId. The problem I facing can be summarized ...
0
votes
2answers
51 views

What's the difference between HMAC-SHA256(key, data) and SHA256(key + data)

Is there anything different about how secure these two hashing algorithms are? Does HMAC "fuse" the data and the key in a special way that's more security-aware?
1
vote
2answers
69 views

HMAC and non-repudiation

This was a question on an exam: Two persons are using a one way communication channel and the HMAC functionality (concretely HMAC-SHA1). Choose the correct statement below: 1) We can prove who the ...
2
votes
0answers
63 views

Using HMAC to generate secret keys

I am developing a platform that uses several secret keys for several usages: key1 for hashing passwords (using pbkdf2-hmac-sha256), key2 to generate non-repeating unpredictable uuids (using aes-128 ...
1
vote
1answer
64 views

HMAC + AES to guarantee secrecy and integrity?

As an exercise, I am writing some code that accepts a list of possibly secret properties (e.g. user ID, password, IP address), adds a timestamp, encrypts it, and signs it. Here's a high-level ...
0
votes
1answer
120 views

Authentication and security of a REST API

Scenario: I design a REST API where authenticated users can hit the API over TLS. I have to use TLS as the data transmitted over the wire is sensitive. I don't need authorization right now, but I ...
1
vote
1answer
65 views

Unusual design aspects of AWS HMAC-based authentication, v4

I am designing a RESTful API in python. I want to use HMAC authentication. I could not find any suitable HMAC libraries, so I am rolling my own. However I want to use a well-known standard such as AWS ...
1
vote
2answers
49 views

Is it secure to split information into multiple packets?

I just stumbled upon this SO question. I was wondering if it would be still secure to split the encrypted packet into multiple packets, which are then transferred over the wire separately. Could ...
0
votes
2answers
68 views

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique ...
9
votes
2answers
858 views

Timing attack against HMAC in authenticated encryption?

In an answer to another question of mine, it was noted that a class using standard string comparison functions when checking the HMAC in authenticated encryption would make the class vulnerable to ...
7
votes
1answer
520 views

Is there a method to get plain-text from cipher-text in HMAC SHA-1, given that the key is known?

This is technically not even an attack. We have all the resources at hand, except for the original plain-text. We have the cipher-text (to be converted back to plain-text), as well as the key. The ...
1
vote
1answer
178 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
0
votes
1answer
68 views

Does encrypting the message protect it against length extension attacks

Assuming the following HMAC is used : HMACK(M) = Hash(K||M) = H which is "secret-prefix" hashed function. M is the plaintext message , K is the secret key used The ciphertext is generated as follow : ...
0
votes
1answer
45 views

Securing connection between redirect from A to B domain

I'm building special extension ( on domain B ) to the present e-commerce hosted on a domain A. The goal is to redirect user from A to B and back. Similar to technique where user leaves e-commerce site ...
3
votes
1answer
105 views

Encryption and HMAC with the same password

I need to send authenticated ciphered messages by using a single password. Reusing the same (derived) key for the block cipher and the HMAC is not a good practice, I know. My initial idea is to ...
0
votes
2answers
89 views

Should I use HMAC in this situation

I need to store a big message encrypted on a server. What I am about to do is: Encrypt the message with a AES key; (Authentication) Hash the message with SHA512 and encrypt the hash with RSA priv ...
0
votes
0answers
45 views

Using HMAC when sending data through an untrusted server

I have a set up like this: Payment Server (PS) <> Front End (FE) <> Client JS. I need to get some data from the Client JS to the PS, without the FE being able to modify it and have PS prove ...
2
votes
1answer
99 views

How secure is HMAC

I'm a building a RESTful stateless API and I'm using a token for authentication. The problem I'm having is I'm not sure how secure HMAC is. I'm using a JSON Web Token library that let's me encrypt ...
5
votes
3answers
102 views

Why can't a cryptographic hash inside a cryptogram serve as a MAC? [duplicate]

My question is closely related to Why do you need message authentication in addition to encryption? Specifically I am interested in symmetric-key cryptography. I understand that attackers may modify ...
0
votes
1answer
93 views

Node's createHmac function

for the node.js crypto command: crypto.createHmac('this is a test', key); What is node expecting for key's encoding? utf8? a binary buffer?
1
vote
1answer
56 views

Use TOTP to prevent simulating requests

I'm developing an API system which provides functionalities for a game. Currently, we are using HMAC to prevent simulating requests (let's say, prevent hackers from simulating the game) but because we ...
0
votes
0answers
33 views

Authentication for Restful web services [duplicate]

I am building a restful web services. My requirement is that I have to provide authentication for accessing the webservices. First I tried with basic authentication. Which is working fine, but ...
0
votes
1answer
125 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
2
votes
2answers
53 views

Is the HMAC weakened if a part of the message is part the key?

For example: I am using HMAC SHA 256 to sign an XML file. Part of the file data is a version number. If I append the version to my secret to use it as a key, does that weaken the HMAC? As the version ...
-1
votes
1answer
77 views

Can HMAC leak the password? [duplicate]

Imaging the following pseudo-code: h = hash(sha512) h.input(password) h.input(message) send h, message to client If the user has the hash and the message, and the only missing variable is the ...
0
votes
1answer
304 views

Password Storage with Jasypt StrongPasswordEncryptor vs PBKDF2

We are currently working on authentication for a web application. For password storage, we're using Jasypt StrongPasswordEncryptor with SHA-256 and tens of thousands of iterations. Going into the ...
0
votes
0answers
62 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...
6
votes
1answer
108 views

4 bytes authentication problem

I have a classic security problem where Alice needs to prove its identity to Bob but with quite unusual requirements and constraints due to a M2M context. EDITs in bold The communication channel ...
0
votes
0answers
74 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
3
votes
1answer
147 views

When to use HMAC alongside AES?

One of my clients wants to provide an URL to each of his customers to register in a system. This URL would contain a query string parameter with some data (e.g. code, email and name) from his clients ...
0
votes
1answer
53 views

Does ASP.NET guarantee the integrity of a page's controls on a post back?

Say you have an ASP.NET page that lists the prices for certain items in labels. I know it's cringe-worthy, but say you took the price of the item from the label on the page to determine what the user ...
0
votes
1answer
140 views

Using hashed password as secret key for hmac to avoid exchange of secret between server and client

I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with ...
1
vote
1answer
100 views

Should HMAC key be changed regularly? Should it be kept secret at all times?

I am doing an HMAC of some cipher-text, IV and encryption algorithm. Right now I am using a hard-coded key that is known to both sender and receiver. I was wondering if the key should be changed once ...
2
votes
1answer
654 views

HMAC secret key client storage

I've read numerous articles about using HMAC and the secret key for client authentication in a RESTful client (Javascript) application today. Still, I don't find a single source that is able to ...
0
votes
1answer
83 views

Is this signature methodology secure?

I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
0
votes
1answer
559 views

Openssl ciphers SHA384 and AEAD

When running the command: openssl ciphers -v I get a long list of cipher combinations. I'm having issues interpreting some of them. An example is: DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA ...
-1
votes
1answer
94 views

Where are MAC used?

I can think of where people use hashes and signatures. But where are MAC used in real life? Are there any protocol in cryptography that uses MAC? Or examples where MACs are relevant?
1
vote
1answer
268 views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
1
vote
0answers
140 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
1answer
191 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
0answers
140 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
4
votes
0answers
773 views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
2
votes
1answer
83 views

What is the purpose of derivation of encryption and authorization keys from master key?

We're using AES-CBC and HMAC to encrypt and authenticate our messages (using encrypt-then-authenticate method). Sometimes I see solutions (like this one) which are deriving encryption and ...
1
vote
0answers
144 views

Is hashing the HMAC secret key a good idea?

I'm implementing a REST API and I've generated 128-bit random API keys which are used with HMAC-SHA1 for authorization. Should I hash the secret key on both the client and server before using it, ...
1
vote
3answers
149 views

Detect message tampering without shared key and without certificate authority

Is it possible to detect if a message has been tampered with, without using MAC (i.e. shared key) and without using a "trusted" third party (i.e. certificate authority)? I'm pretty sure it's not, but ...
2
votes
1answer
181 views

Avoiding Replay Attacks on Lightweight Channel

I'm in the process of building a network of small devices (ARM microcontrollers with something like nRF24L01 connectivity). The controllers will be receiving commands from a central system over these ...
3
votes
1answer
2k views

HMAC solution for a rest API

I'm trying to learn some things about REST apis and one of the topics that I'm having some trouble is security. I'm using angularjs for web interface ans slim framework for the php api. I've read ...