Questions tagged [hmac]

a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
0
votes
1answer
49 views

REST API is protected by HMAC based authentication. What does including URL path in the message protect from?

I have came across a REST API for some commercial software, that checks authentication by requiring HMAC on concatenation of http_method (GET, PUT, etc) timestamp payload (body of a POST / PUT ...
1
vote
0answers
95 views

How to uses FIDO2 hmac-secret extension for offline authentication? [closed]

How hmac-secret extension defined in the CTAP2 Specification is used to help implement offline authentication with an authenticator. Is there any other specification that says how to do this? From the ...
1
vote
1answer
89 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
0
votes
1answer
24 views

Need a test vector for the putty ssh-2 file mac validation

I'm trying to implement the putty file format in one of my dart packages. Implementing the actual key loading was ok, but I'm struggeling with the mac validation. I'm not shure what I'm doing wrong ...
2
votes
1answer
55 views

Using encryption key as input keying material

Libsodium supports Blake2 for key derivation. It seems like you shouldn't truncate the output to get two keys (eg one encryption/one mac) as the recommended way is to use a counter as the salt for ...
0
votes
0answers
21 views

Does TLS provide data integrity? [duplicate]

I've looked around on this site and I've not seen a clear answer on this question. From what I've read TLS does not provide data integrity unless specific ciphers are used which use HMAC'ing as part ...
1
vote
1answer
96 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
1
vote
0answers
22 views

HMAC with random application Id and secret with DPAPI

We have open endpoints because there is a flow where access token is still not presented. Because of that, I've implemented HMAC + DPAPI (using Azure Blob Storage) to store the keys, without involving ...
0
votes
0answers
22 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
2
votes
1answer
564 views

Which one to use AES : GCM vs CBC

I am planning to encrypt database fields using AES encryption. Now, this encrypted data will not transfer over the internet and will reside in our own datacenter only. From what I read, GCM mode ...
1
vote
2answers
71 views

Terminology question - authentication through encryption

I came across a number of somewhat similar solutions, which are based on the knowledge factor related to a symmetric key in particular: If a party was able to generate correct message authentication ...
1
vote
1answer
52 views

Why HMAC/Signed API requests are not prevalent compared to API keys or JWT based requests

While all/majority of AWS APIs requests are signed with HMAC, it is not as prevalent for other APIs in general. Most likely, the reason is because of the gotchas involved when client has to make the ...
0
votes
0answers
59 views

What is the need of HMAC in Diffie-Hellman? [duplicate]

When Alice and Bob both have the same shared secret to encrypt their data (Diffie-Hellman) and Alice encrypts her data with this key and Bob can decrypt it with the same key, then Bob knows that the ...
0
votes
0answers
161 views

cracking HMAC-SHA1 when the password and seed are inverted

I happen to have a few hashes generated with code that did this (it has been changed to use a more "standard" bcrypt call): $ python3 >>> import hmac >>> hmac.new(b'The ...
4
votes
1answer
125 views

Can I HMAC my plaintext for use as a NACL SecretBox nonce?

I'm writing an application that needs to deterministically encrypt some data (where two equal ciphertexts will produce two equal plaintexts; this is acceptable and in fact desirable for this ...
0
votes
0answers
122 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
1
vote
0answers
47 views

Signing event-stream responses

I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
0
votes
1answer
139 views

Is HMAC-SHA256 more secure to hide information than SHA256?

I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
-1
votes
1answer
51 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
0
votes
1answer
49 views

Is HMAC really a benefit for AES-CBC?

I think I quite well understand the theoretical benefit of adding the HMAC (authenticity/integrity on top of confidentiality), but I am looking at this from a key management point-of-view. Premise: ...
2
votes
1answer
91 views

How does Algolia's virtual API keys work?

Algolia allows you to generate virtual/secured API keys from another parent API key but without a call to their servers. A virtual key thus generated on the server side with a defined "scope" (like ...
0
votes
1answer
64 views

What advantage does HMAC provide in generating short hashes comparing to regular hash function?

This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec. In this ...
0
votes
1answer
413 views

How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?

I just got my Yubikey 5 NFC, and would like to use it for Linux desktop login Linux KeePassXC (which only supports hmac-sha1 challenge-response) online accounts When reading about U2F it seams to be ...
1
vote
1answer
75 views

Can I use PBKDF2 derivation function to generate a MAC in PKCS12 file?

It seems that the default password based key derivation function that is used by PKCS12 to generate a MAC is this one. It is unique to the standard and probably not used anywhere else. Is it possible ...
2
votes
2answers
835 views

How do backup codes work in TOTP, like Google Authenticator?

My understanding is that in TOTPs are like HMAC where code is derived from time. However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
0
votes
1answer
162 views

Are short messages hashed with a HMAC insecure?

Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key. Would this person be able to derive any information about my secret key?...
0
votes
1answer
74 views

Is it secure to use HMAC to pass a string to be verified?

I am working on a Django project and trying to create a REST API to verify email without using any database. My present server connection is HTTP and not HTTPS. So someone using the API end point ...
0
votes
0answers
41 views

Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk

In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
1
vote
1answer
110 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
0
votes
0answers
61 views

Is this symmetric key system secure?

I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme. Secrets The secret is a password that is known to both clients. This ...
1
vote
0answers
49 views

concatenation vs multiple rounds of HMAC

I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions). Specifically this: kSecret = Your AWS Secret Access ...
1
vote
0answers
193 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
3
votes
1answer
463 views

HMAC and integrity

I'm studying network security and I found this question in my slide, but don't have an answer. Discuss the use of keyed HMACs for guaranteeing the integrity of a file being transmitted over the ...
7
votes
2answers
4k views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
0
votes
1answer
119 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
0
votes
3answers
127 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
7
votes
1answer
237 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
0
votes
1answer
95 views

Is HMAC preferable to Digital signature

I'm new to infosec. I'm studying about various encryption algorithms. Based on what I've found so far, I think HMAC and Digital signature are almost the same except whether the key is symmetric or ...
0
votes
1answer
98 views

Can I securely share an HMAC key over a TLS connection?

In a game client/server that I'm developing, I want to allow a user to authenticate over TLS (via a REST endpoint on an HTTPS server) before dropping to an unencrypted low-latency UDP protocol. To ...
0
votes
2answers
258 views

How to protect HMAC key embedded in code from someone who would copy entire source?

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API. We realized that someone could then easily hook up to our API and make a ...
1
vote
3answers
988 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
1
vote
1answer
156 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
5
votes
2answers
3k views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
1answer
157 views

hmac based request signature for verification

say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a ...
2
votes
1answer
475 views

Calculating HMAC

I've been trying to learn how HMAC is calculated but seem to be missing something. According to this wiki page, calling HMAC-SHA1 on an empty key and message should result in a value of ...
6
votes
1answer
377 views

Is this vault-less password manager/generator design safe?

Counter The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
0
votes
2answers
427 views

Is it reasonable to store HMAC secret key in memory only?

I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization. I've been thinking ...
15
votes
2answers
2k views

How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?

I'm currently managing a code base in which we've got a mysql database with all records encrypted using the php-encryption library. This works well for our current setup. We now got a new business ...
1
vote
1answer
205 views

Is AES+hash rather than HMAC problematic?

I will now ask a strange question, but bear with me. I can't share the entire usecase, but the point is to allow the holder of a secret key to create "strings" (used in other systems). The strings ...
2
votes
1answer
60 views

Proof of information having been created before it is released

I have been thinking about the following use-case: some institution wants to organize bets about an outcome that is of its own choosing. The timeline is as follows: The organization chooses the ...

1
2 3 4 5 6