a method for constructing a message authentication code based on a cryptographic hash function.

learn more… | top users | synonyms

1
vote
1answer
12 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
-4
votes
0answers
17 views

HMAC- SHA 256- algorithm? [on hold]

Can any one provide me a complete algorithm, how to do hash computation with a complete example.
-1
votes
0answers
16 views

HMAC based authentification token [closed]

I'm wondering if it would be a good idea to use HMAC based token (as used in OTP) or something similar. The workflow would be to authenticate with a password and then to give him a first token, used ...
2
votes
2answers
41 views

Is the HMAC weakened if a part of the message is part the key?

For example: I am using HMAC SHA 256 to sign an XML file. Part of the file data is a version number. If I append the version to my secret to use it as a key, does that weaken the HMAC? As the version ...
-1
votes
1answer
67 views

Can HMAC leak the password? [duplicate]

Imaging the following pseudo-code: h = hash(sha512) h.input(password) h.input(message) send h, message to client If the user has the hash and the message, and the only missing variable is the ...
0
votes
1answer
88 views

Password Storage with Jasypt StrongPasswordEncryptor vs PBKDF2

We are currently working on authentication for a web application. For password storage, we're using Jasypt StrongPasswordEncryptor with SHA-256 and tens of thousands of iterations. Going into the ...
0
votes
0answers
36 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...
6
votes
1answer
89 views

4 bytes authentication problem

I have a classic security problem where Alice needs to prove its identity to Bob but with quite unusual requirements and constraints due to a M2M context. EDITs in bold The communication channel ...
0
votes
0answers
41 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
3
votes
1answer
112 views

When to use HMAC alongside AES?

One of my clients wants to provide an URL to each of his customers to register in a system. This URL would contain a query string parameter with some data (e.g. code, email and name) from his clients ...
0
votes
1answer
33 views

Does ASP.NET guarantee the integrity of a page's controls on a post back?

Say you have an ASP.NET page that lists the prices for certain items in labels. I know it's cringe-worthy, but say you took the price of the item from the label on the page to determine what the user ...
0
votes
1answer
74 views

Using hashed password as secret key for hmac to avoid exchange of secret between server and client

I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with ...
1
vote
1answer
60 views

Should HMAC key be changed regularly? Should it be kept secret at all times?

I am doing an HMAC of some cipher-text, IV and encryption algorithm. Right now I am using a hard-coded key that is known to both sender and receiver. I was wondering if the key should be changed once ...
1
vote
1answer
223 views

HMAC secret key client storage

I've read numerous articles about using HMAC and the secret key for client authentication in a RESTful client (Javascript) application today. Still, I don't find a single source that is able to ...
0
votes
1answer
51 views

Is this signature methodology secure?

I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
0
votes
1answer
116 views

Openssl ciphers SHA384 and AEAD

When running the command: openssl ciphers -v I get a long list of cipher combinations. I'm having issues interpreting some of them. An example is: DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA ...
0
votes
1answer
87 views

Where are MAC used?

I can think of where people use hashes and signatures. But where are MAC used in real life? Are there any protocol in cryptography that uses MAC? Or examples where MACs are relevant?
0
votes
1answer
122 views

What is a AUTH-KEY in the security of the computers?

I don't know if this is the right section to post my question and if it is not I apologize. I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL ...
1
vote
0answers
104 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
1answer
136 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
0
votes
0answers
83 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
1
vote
0answers
201 views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
2
votes
1answer
70 views

What is the purpose of derivation of encryption and authorization keys from master key?

We're using AES-CBC and HMAC to encrypt and authenticate our messages (using encrypt-then-authenticate method). Sometimes I see solutions (like this one) which are deriving encryption and ...
1
vote
0answers
108 views

Is hashing the HMAC secret key a good idea?

I'm implementing a REST API and I've generated 128-bit random API keys which are used with HMAC-SHA1 for authorization. Should I hash the secret key on both the client and server before using it, ...
1
vote
3answers
72 views

Detect message tampering without shared key and without certificate authority

Is it possible to detect if a message has been tampered with, without using MAC (i.e. shared key) and without using a "trusted" third party (i.e. certificate authority)? I'm pretty sure it's not, but ...
2
votes
1answer
109 views

Avoiding Replay Attacks on Lightweight Channel

I'm in the process of building a network of small devices (ARM microcontrollers with something like nRF24L01 connectivity). The controllers will be receiving commands from a central system over these ...
2
votes
1answer
945 views

HMAC solution for a rest API

I'm trying to learn some things about REST apis and one of the topics that I'm having some trouble is security. I'm using angularjs for web interface ans slim framework for the php api. I've read ...
0
votes
1answer
457 views

Which is better in “DH-group14-sha1 with hmac-sha2-256” and “DH-group-exchange-sha256 with hmac-sha2-256” from performance and security perspective?

In our product (embedded system), so far we were using diffie-hellman-group1-sha1 with hmac-sha1. But due to security concern we are planning to use diffie-hellman-group14 for key exchange and ...
1
vote
0answers
546 views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
3
votes
3answers
125 views

How to simply and efficiently generate different keys from one password?

I saw here that using the same key to encrypt and mac (in that order) a message could eventually be unsafe. What is the best way to generate two different keys from the same password (using a PBKDF ...
1
vote
1answer
317 views

SSO via HMAC and shared key. Can this be improved?

Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic: A.com and B.com both share key S. ...
0
votes
2answers
176 views

Have I crossed my t's and dotted my lower-case j's? (or, implementing AES, please help get some eyes on my code)

So, I used the crypto module in node.js to implement a secure key generator and encrypt/decrypt functions. Knowing that security's best friend is a spotlight on the implementation, I want to throw it ...
2
votes
1answer
222 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
1
vote
1answer
78 views

Is there an advantage to applying pbkdf2 to a key that's used to generate a MAC?

We need to generate tamper-resistant URLs to access a service, which are then shared with the end-user. The URLs don't contain any confidential data, but we need to ensure that they have not been ...
3
votes
1answer
154 views

using counter instead of salt for hashing

I'm developing own protocol for secure message exchanging. Each message contains the following fields: HMAC, time, salt, and message itself. HMAC is computed over all other fields using known secret ...
1
vote
1answer
258 views

What key to use in HMAC

I need to use HMAC on a certain message to guarantee integrity, but I cannot figure out what are the requirements for the key to be given as input to the hashing algorithm. In particular I have to ...
0
votes
1answer
67 views

What key needs to be used to compute HMAC?

I use AES-128bit to encrypt files and I want to compute a HMAC for each one of the encrypted files to ensure their integrity. Can I use directly the AES KEY to compute HMAC or should I used a derived ...
1
vote
1answer
847 views

How is the HMAC key exchanged?

Just wondering about this. Does it need a PKI to work?
2
votes
1answer
363 views

What extra protection is added to an REST API over HTTPS by the use of some kind of HMAC?

I'm designing a RESTFUL API that will always be used over HTTPS, what security advantages over the use of HTTP Basic Auth could be brought to my system by using such kind of message authentication ...
2
votes
2answers
1k views

Is this REST service authentication system secure?

I have to implement a token based authentication for a RESTful web service. This is the first time I'm implementing security features in a software, and this is what I have in mind for now : The ...
1
vote
0answers
159 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
5
votes
1answer
7k views

Security for REST api (user/pass auth vs hmac vs oauth)

I have two servers (one on Hetzner (I am calling it H) and other in my office (calling it O) ). I need to run a basic CRUD web service on O and the only consumer of the service is H. Data on O is ...
2
votes
2answers
74 views

Which signing strategy?

I have a device which should lock and unlock something after receiving a signed server response. So in the best case a loop would lock like this: User locks device User wants to unlock device User ...
-5
votes
2answers
118 views

Protection of online image file (ancient manuscript) [duplicate]

I am going to protect an image file (ancient manuscript) which will be available online for everyone to download. I want to protect the file in these situations: When it's on the server, I need to ...
2
votes
1answer
932 views

NIST test vectors for HMAC-SHA-256

I'm working on an implementation of HMAC-SHA-256 in classic ASP (legacy code). I currently have it working, and the resulting values are correct compared to some test cases I came up with along with ...
9
votes
1answer
873 views

Why can't I use the same key for encryption and MAC?

I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC, I think I made a mistake by using the same key for both. ...
9
votes
3answers
895 views

API message verification without storing private key?

I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved. It seems the current common practice for "authenticating" users in API requests is ...
7
votes
3answers
3k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
6
votes
1answer
870 views

Why a symmetric key for HMAC?

I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
4
votes
3answers
247 views

What SSL options should not be used?

What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.