Questions tagged [hmac]

a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
0
votes
1answer
75 views

Is HMAC-SHA256 more secure to hide information than SHA256?

I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
-1
votes
1answer
49 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
0
votes
1answer
40 views

Is HMAC really a benefit for AES-CBC?

I think I quite well understand the theoretical benefit of adding the HMAC (authenticity/integrity on top of confidentiality), but I am looking at this from a key management point-of-view. Premise: ...
2
votes
1answer
78 views

How does Algolia's virtual API keys work?

Algolia allows you to generate virtual/secured API keys from another parent API key but without a call to their servers. A virtual key thus generated on the server side with a defined "scope" (like ...
0
votes
1answer
60 views

What advantage does HMAC provide in generating short hashes comparing to regular hash function?

This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec. In this ...
0
votes
1answer
129 views

How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?

I just got my Yubikey 5 NFC, and would like to use it for Linux desktop login Linux KeePassXC (which only supports hmac-sha1 challenge-response) online accounts When reading about U2F it seams to be ...
0
votes
1answer
51 views

Can I use PBKDF2 derivation function to generate a MAC in PKCS12 file?

It seems that the default password based key derivation function that is used by PKCS12 to generate a MAC is this one. It is unique to the standard and probably not used anywhere else. Is it possible ...
2
votes
2answers
259 views

How do backup codes work in TOTP, like Google Authenticator?

My understanding is that in TOTPs are like HMAC where code is derived from time. However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
0
votes
1answer
103 views

Are short messages hashed with a HMAC insecure?

Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key. Would this person be able to derive any information about my secret key?...
0
votes
1answer
66 views

Is it secure to use HMAC to pass a string to be verified?

I am working on a Django project and trying to create a REST API to verify email without using any database. My present server connection is HTTP and not HTTPS. So someone using the API end point ...
0
votes
0answers
34 views

Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk

In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
1
vote
1answer
69 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
0
votes
0answers
59 views

Is this symmetric key system secure?

I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme. Secrets The secret is a password that is known to both clients. This ...
1
vote
0answers
38 views

concatenation vs multiple rounds of HMAC

I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions). Specifically this: kSecret = Your AWS Secret Access ...
1
vote
0answers
110 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
2
votes
1answer
224 views

HMAC and integrity

I'm studying network security and I found this question in my slide, but don't have an answer. Discuss the use of keyed HMACs for guaranteeing the integrity of a file being transmitted over the ...
6
votes
2answers
803 views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
0
votes
1answer
94 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
0
votes
3answers
91 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
6
votes
1answer
216 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
0
votes
0answers
76 views

Is it safe to share an Azure SAS token with an untrusted client?

We need to host files in Azure Blob Store, and allow access to end users to their generated "statements"(pdf) for a short period of time. We're considering achieving this by generating a short-lived ...
0
votes
1answer
75 views

Is HMAC preferable to Digital signature

I'm new to infosec. I'm studying about various encryption algorithms. Based on what I've found so far, I think HMAC and Digital signature are almost the same except whether the key is symmetric or ...
0
votes
1answer
72 views

Can I securely share an HMAC key over a TLS connection?

In a game client/server that I'm developing, I want to allow a user to authenticate over TLS (via a REST endpoint on an HTTPS server) before dropping to an unencrypted low-latency UDP protocol. To ...
0
votes
2answers
198 views

How to protect HMAC key embedded in code from someone who would copy entire source?

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API. We realized that someone could then easily hook up to our API and make a ...
1
vote
3answers
529 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
1
vote
1answer
107 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
3
votes
2answers
2k views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
1answer
141 views

hmac based request signature for verification

say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a ...
2
votes
1answer
412 views

Calculating HMAC

I've been trying to learn how HMAC is calculated but seem to be missing something. According to this wiki page, calling HMAC-SHA1 on an empty key and message should result in a value of ...
6
votes
1answer
348 views

Is this vault-less password manager/generator design safe?

Counter The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
0
votes
2answers
350 views

Is it reasonable to store HMAC secret key in memory only?

I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization. I've been thinking ...
13
votes
2answers
1k views

How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?

I'm currently managing a code base in which we've got a mysql database with all records encrypted using the php-encryption library. This works well for our current setup. We now got a new business ...
1
vote
1answer
169 views

Is AES+hash rather than HMAC problematic?

I will now ask a strange question, but bear with me. I can't share the entire usecase, but the point is to allow the holder of a secret key to create "strings" (used in other systems). The strings ...
2
votes
1answer
58 views

Proof of information having been created before it is released

I have been thinking about the following use-case: some institution wants to organize bets about an outcome that is of its own choosing. The timeline is as follows: The organization chooses the ...
0
votes
1answer
192 views

Is AES + MAC more secure than encrypting plaintext along with its hash

Suppose I want to encrypt some plaintext and I can only use an unauthenticated AES mode like CBC. One way of adding authentication is encrypt-then-MAC, where the two different keys for AES and MAC ...
1
vote
1answer
451 views

KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password

Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know: Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password? From what I know, the ...
4
votes
1answer
1k views

when should i use HMAC-based JWT?

I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
1
vote
1answer
435 views

Implementation of PMKID computing function

I am trying to implement a function, let's say in Python to compute Pairwise Master Key Identifier (PMKID) after reading the previously discovered bug in WPA2. Googling gave me this logical statement: ...
0
votes
2answers
149 views

Help to review 2FA algorithm

First of all, I know, don't reinvent the wheel... But there's a good reason for this. So I have been implementing a generic 2 factor authentication code generation/validation algorithm in order to re-...
1
vote
1answer
193 views

Is an HMAC hash of plaintext data secure enough to use as a lookup index for encrypted data

I'm working on an app that will download files from external servers over https and store them on disk in a relatively secure way. Specifically, using a cryptographically unique IV, an AES256 cipher ...
5
votes
1answer
1k views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
0
votes
1answer
86 views

HMAC and using a cryptographically safe random field as message

Say that I have a big application for which I would like to create a secure API. The standard way to go would be to work with a public API key and a secret API key and provide these to the user. Next, ...
1
vote
1answer
62 views

Use D Parameter Of Private Key as HMAC Secret for JWT in a Load Balanced Environment

I need to use a signature for a JWT that needs to be created or verified on 12 different servers running in a load balanced environment. They all already have the same RSA Key Pair stored in the ...
5
votes
1answer
107 views

Proper way to combine multiple secrets into one HMAC key?

I am using HMAC+SHA256 to sign and verify claims in a web application. Each deployment has its own crypto-random 512-bit secret that I can use as the HMAC key, but in some cases I want to mix in ...
2
votes
1answer
71 views

What advantages would client-side certificates have over signature based auth such as Oauth2 or HMAC for HTTP Requests?

My application currently supports these two authentications methods OAuth2 and HMAC Auth. OAuth2 https://tools.ietf.org/html/rfc6749 HMAC https://tools.ietf.org/html/draft-cavage-http-signatures-09 ...
1
vote
2answers
2k views

Decoding a HMAC SHA256 when the key is the same as the original string

Theoretically, python function for encrypting a HMAC SHA256 looks like this: hmac_sha256(key, text) The word "hello" was encrypted using the function like so: hmac_sha256("hello", "hello") How ...
0
votes
3answers
161 views

Producing secure hashes to detect data manipulation

I have an Android app that internally relies on a SQLite database that stores encrypted user data. The data is encrypted using AES-256, with a key generated by the PBKDF2-HMACSHA256 algorithm. The ...
-4
votes
1answer
108 views

Collision Free and Keyed-Hash Message Authentication Code [closed]

What is Collision Free? And how does it work? What is HMAC(Keyed-Hash Message Authentication Code)? And how does it work? How authentication can be achieved with HMAC?
0
votes
1answer
240 views

Review on encrypted data storage algorithm

I'm building a small command line tool (mostly for fun) that is meant to store data (such as passwords or files) encrypted into a local database, with a user supplied password, pretty much the same ...
0
votes
1answer
363 views

Is nonce of HMAC secured message considered secret?

Consider app using say, HMAC-SHA2, with securely pre-shared symmetric key. Are the nonces of exchanged messages considered secret as well? Or in other words, does its easy predictability or even ...

1
2 3 4 5