Questions tagged [hmac]

a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
0
votes
2answers
69 views

Is it feasible to calculate an HMAC-SHA512/256 MAC from an environment that only supports HMAC-SHA512?

I need to verify a MAC for something signed with HMAC-SHA512/256, however, the language I'm using (Salesforce's Apex language) doesn't have support for that algorithm. It does have HMAC-SHA512 and ...
0
votes
2answers
59 views

Keyed Hash Function (HMAC) For Unguessable URLs?

I have numeric IDs that I would like to use in filenames. So for example with IDs 1, 2, 3 we would have 1.jpg, 2.jpg, and 3.jpg Now the problem is that clearly a user could just guess 4.jpg and view ...
0
votes
1answer
84 views

Combining confidentiality, authenticity and data integrity to form secure URL

There are clients (mobile application), they can share links to their profile info, which should be confidential. The link expires in 5 minutes (configured). They set Auth-Code so that the one who ...
1
vote
2answers
133 views

Is a simple random+hmac session cookie breakable?

I make session cookies of form session_id+'|'+hmac_sha256(session_id, static_secret) where session_id = random_string(16 bytes) made with a PRNG (not a CSPRNG!) seeded on the server's timestamp at ...
0
votes
2answers
68 views

Does using subkeys provide better protection in this instance?

I was thinking of implementing the following scheme for encryption of many independent files: From the password, which is given by the user, generate a master key using for example HMAC-SHA. From ...
0
votes
0answers
44 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
0
votes
1answer
85 views

REST API is protected by HMAC based authentication. What does including URL path in the message protect from?

I have came across a REST API for some commercial software, that checks authentication by requiring HMAC on concatenation of http_method (GET, PUT, etc) timestamp payload (body of a POST / PUT ...
1
vote
0answers
207 views

How to uses FIDO2 hmac-secret extension for offline authentication? [closed]

How hmac-secret extension defined in the CTAP2 Specification is used to help implement offline authentication with an authenticator. Is there any other specification that says how to do this? From the ...
1
vote
1answer
139 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
0
votes
1answer
31 views

Need a test vector for the putty ssh-2 file mac validation

I'm trying to implement the putty file format in one of my dart packages. Implementing the actual key loading was ok, but I'm struggeling with the mac validation. I'm not shure what I'm doing wrong ...
2
votes
1answer
56 views

Using encryption key as input keying material

Libsodium supports Blake2 for key derivation. It seems like you shouldn't truncate the output to get two keys (eg one encryption/one mac) as the recommended way is to use a counter as the salt for ...
0
votes
0answers
22 views

Does TLS provide data integrity? [duplicate]

I've looked around on this site and I've not seen a clear answer on this question. From what I've read TLS does not provide data integrity unless specific ciphers are used which use HMAC'ing as part ...
1
vote
1answer
101 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
1
vote
0answers
25 views

HMAC with random application Id and secret with DPAPI

We have open endpoints because there is a flow where access token is still not presented. Because of that, I've implemented HMAC + DPAPI (using Azure Blob Storage) to store the keys, without involving ...
0
votes
0answers
25 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
2
votes
1answer
1k views

Which one to use AES : GCM vs CBC

I am planning to encrypt database fields using AES encryption. Now, this encrypted data will not transfer over the internet and will reside in our own datacenter only. From what I read, GCM mode ...
1
vote
2answers
72 views

Terminology question - authentication through encryption

I came across a number of somewhat similar solutions, which are based on the knowledge factor related to a symmetric key in particular: If a party was able to generate correct message authentication ...
1
vote
1answer
61 views

Why HMAC/Signed API requests are not prevalent compared to API keys or JWT based requests

While all/majority of AWS APIs requests are signed with HMAC, it is not as prevalent for other APIs in general. Most likely, the reason is because of the gotchas involved when client has to make the ...
0
votes
0answers
61 views

What is the need of HMAC in Diffie-Hellman? [duplicate]

When Alice and Bob both have the same shared secret to encrypt their data (Diffie-Hellman) and Alice encrypts her data with this key and Bob can decrypt it with the same key, then Bob knows that the ...
0
votes
0answers
233 views

cracking HMAC-SHA1 when the password and seed are inverted

I happen to have a few hashes generated with code that did this (it has been changed to use a more "standard" bcrypt call): $ python3 >>> import hmac >>> hmac.new(b'The ...
4
votes
1answer
137 views

Can I HMAC my plaintext for use as a NACL SecretBox nonce?

I'm writing an application that needs to deterministically encrypt some data (where two equal ciphertexts will produce two equal plaintexts; this is acceptable and in fact desirable for this ...
0
votes
0answers
174 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
1
vote
0answers
47 views

Signing event-stream responses

I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
0
votes
1answer
250 views

Is HMAC-SHA256 more secure to hide information than SHA256?

I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
-1
votes
1answer
52 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
0
votes
1answer
61 views

Is HMAC really a benefit for AES-CBC?

I think I quite well understand the theoretical benefit of adding the HMAC (authenticity/integrity on top of confidentiality), but I am looking at this from a key management point-of-view. Premise: ...
2
votes
1answer
94 views

How does Algolia's virtual API keys work?

Algolia allows you to generate virtual/secured API keys from another parent API key but without a call to their servers. A virtual key thus generated on the server side with a defined "scope" (like ...
0
votes
1answer
65 views

What advantage does HMAC provide in generating short hashes comparing to regular hash function?

This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec. In this ...
0
votes
1answer
483 views

How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?

I just got my Yubikey 5 NFC, and would like to use it for Linux desktop login Linux KeePassXC (which only supports hmac-sha1 challenge-response) online accounts When reading about U2F it seams to be ...
1
vote
1answer
99 views

Can I use PBKDF2 derivation function to generate a MAC in PKCS12 file?

It seems that the default password based key derivation function that is used by PKCS12 to generate a MAC is this one. It is unique to the standard and probably not used anywhere else. Is it possible ...
3
votes
2answers
1k views

How do backup codes work in TOTP, like Google Authenticator?

My understanding is that in TOTPs are like HMAC where code is derived from time. However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
1
vote
1answer
187 views

Are short messages hashed with a HMAC insecure?

Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key. Would this person be able to derive any information about my secret key?...
0
votes
1answer
86 views

Is it secure to use HMAC to pass a string to be verified?

I am working on a Django project and trying to create a REST API to verify email without using any database. My present server connection is HTTP and not HTTPS. So someone using the API end point ...
0
votes
0answers
45 views

Does transmitting short, predictable plaintext along with the HMAC signature of that text present a security risk

In order to allow clients to verify responses originating from our server, we are generating an HMAC signature of the body and a timestamp, and attaching it as a header. The timestamp is also attached ...
1
vote
1answer
133 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
0
votes
0answers
61 views

Is this symmetric key system secure?

I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme. Secrets The secret is a password that is known to both clients. This ...
1
vote
0answers
59 views

concatenation vs multiple rounds of HMAC

I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions). Specifically this: kSecret = Your AWS Secret Access ...
1
vote
0answers
227 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
3
votes
1answer
576 views

HMAC and integrity

I'm studying network security and I found this question in my slide, but don't have an answer. Discuss the use of keyed HMACs for guaranteeing the integrity of a file being transmitted over the ...
7
votes
2answers
5k views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
0
votes
1answer
156 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
0
votes
3answers
147 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
7
votes
1answer
251 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
0
votes
1answer
116 views

Is HMAC preferable to Digital signature

I'm new to infosec. I'm studying about various encryption algorithms. Based on what I've found so far, I think HMAC and Digital signature are almost the same except whether the key is symmetric or ...
0
votes
1answer
114 views

Can I securely share an HMAC key over a TLS connection?

In a game client/server that I'm developing, I want to allow a user to authenticate over TLS (via a REST endpoint on an HTTPS server) before dropping to an unencrypted low-latency UDP protocol. To ...
0
votes
2answers
294 views

How to protect HMAC key embedded in code from someone who would copy entire source?

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API. We realized that someone could then easily hook up to our API and make a ...
1
vote
3answers
1k views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
1
vote
1answer
175 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
5
votes
2answers
4k views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
1answer
160 views

hmac based request signature for verification

say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a ...

1
2 3 4 5 6