New answers tagged hmac
Your invented scheme releases "a hash (or HMAC) of the HMAC key", relies on trusted timestamping, and allows an attacker to exchange "the message she wants to publish" with "the hash of the replacement HMAC key". The following is a viable way to do what you're trying: Alice wants to publicly share authenticated messages using only a secret password. ...
If I understand you correctly, you're using a known (i.e. visible to an attacker) piece of information as part of your key. If this is the case, then you are absolutely weaking your HMAC, because you're reducing the amount of unknown keyspace they need to bruteforce to forge a message. For example, if you're using a 128-bit key with your HMAC, but 32 of ...
No, its not weakened. The HMAC ensures that even if some of the key is known, the remainder remains unchanged. Otherwise there would be zeroes instead of the version number. However, the HMAC isn't made "stronger" either.
Not very familiar with how a server would be able to hide a global pepper constant but my take is that sooner or later a hacker that has penetrated the server will figure out how to capture the pepper value. To make a pepper value totally secure would require special hardware. One way to do this would be to use a FPGA board installed in the server. The ...
Top 50 recent answers are included