Questions tagged [hmac]

a method for constructing a message authentication code based on a cryptographic hash function.

Filter by
Sorted by
Tagged with
0
votes
2answers
657 views

Securing non-consumer machine-to-machine APIs with Encryption over SSL

I'm working on an API that is intended to be consumed by another system. The data is not owned by the requesting machine and the user(s) that the data pertains to are not driving the transaction. You ...
2
votes
1answer
120 views

Is there value to signing microservice calls with an HMAC derived from the same private key?

I had a friend say: We're securing our microservice with an HMAC derived from the private key in the jks file. [Where client and server shared the same private key] I can understand the situation ...
1
vote
1answer
372 views

How is HMAC better than MAC? [closed]

I was recently studying about Message Authentication Code (MAC) and Hashed based Message Authentication Code( HMAC). What I understood is MAC takes the message and a shared secret key and applies ...
0
votes
2answers
4k views

Recover key in HMAC-SHA256 message authentication [closed]

I am working on a demonstration of cookie security, where some important data is passed to the client along with a HMAC-SHA256 digest to prevent modification of the data. I would like to be able to ...
0
votes
1answer
199 views

How do Message Authentication Codes provide source authentication

I have heard that Message Authentication Codes give source authentication. But I am a little confused. Message authentication makes a hash code by hashing data or message and when the packet arrives ...
0
votes
1answer
990 views

JWT with SSL still need HMAC or RSA signature or I am just paranoid?

I am trying to implement an authentication/authorization system using JWT for my web application. The clients are provided with a token on the usual JWT format from my server once they present ...
9
votes
1answer
4k views

Shared secret when using JWT with an HMAC for authentication

I'm currently implementing user authentication on a REST-like API that is used by an Android client. After some research I think that JWT (JSON Web Token) is a good way to do it. The basic procedure ...
0
votes
1answer
166 views

Why does scrypt need HMAC? [duplicate]

I don't understand how HMAC can be used in the scrypt algorithm. For what purpose does scrypt use HMAC?
0
votes
1answer
77 views

Protecting Session Authentication Tokens

I am creating a session authentication token and sending it to the client application. Any user data etc is associated to this token on the database, so the token does not contain any sensitive ...
3
votes
1answer
2k views

How the HMAC secret key is exchanged?

I stumbled upon a code where the secret key for HMAC has been hard coded into C# client and server code. I've watched 5 videos about HMAC and many articles and none of them doesn't specify how the ...
2
votes
1answer
220 views

Can data be appended to messages without changing the hash?

I recently learned about message authentication codes at uni and the lecturer said that it's important to use a padding to make the message an integer multiple of a certain length before hashing ...
2
votes
1answer
4k views

How to perform in-browser signing of data with Javascript using HMAC-SHA512?

My client-side JavaScript program needs to make HTTP posts to a service that requires POST data to be signed by my private "secret" according to the HMAC-SHA512 method. I have the "secret", but I ...
-1
votes
1answer
100 views

Is this symmetric key MAC-then-encrypt auth token methodology secure? [closed]

NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be ...
1
vote
1answer
261 views

MAC Timing Attack Xbox 360

I was reading my textbook, Katz and Lindell's Intro to Modern Cryptography in the section about Message Authentication Codes. They were talking about timing attacks in general and brought up an ...
2
votes
1answer
316 views

The application of HMAC vs CMAC vs DAA

So HMAC, CMAC, DAA are different algorithms for generating MAC based symmetric block ciphers. If all use symmetric ciphers to produce MAC, what is the key difference between them? In other word, why ...
3
votes
6answers
556 views

Is it safe to use HMAC with a public key for the purpose of salting?

I would like to store password hashes in a database. In order to prevent dictionary attacks, I was thinking to use HMAC with a key parameter which is public - like user id. That means the user id ...
5
votes
1answer
3k views

How vulnerable is IPSec HMAC-SHA1

There are a few references out there that say HMAC-SHA2 must be used over HMAC-SHA1. If I am using an IPsec link with HMAC-SHA1, how vulnerable is it to being intercepted and cracked?
0
votes
2answers
3k views

OpenVPN: How safe is a 24-7 open port static key setup? With proper encryption used. (AES256)

In a normal setup (cert), you have a strong encryption - just like here - for example, AES256. But you also use dh and the tls params. Just to be absolutely secure. Now, if you use the static key ...
3
votes
3answers
2k views

Authentication with client certificate vs HMAC

I'm designing an API intended for use by a very limited number of trusted clients, likely a server cluster. The API can be accessed only through HTTPS. To authenticate the clients, I'm considering 3 ...
0
votes
1answer
58 views

Security Concerns in an Inventory TOTP Scheme using Time-Variant Keys

Assume we chose to change the secret key in HMAC generation for TOTP, every second. How can we authenticate to such a scheme assuming a 32 byte key is randomly generated passing posix time to srand() ...
1
vote
1answer
871 views

encryption and data integrity

I'm a bit of mixed up on this subject. Does asymmetric encryption like in RSA, ensure message integrity without hashing the message with an HMAC, nothing else is required, or is hashing necessary only ...
2
votes
2answers
699 views

What does it mean that Hmac is secure?

I'm not taking about general collision attack on weak hash function such as MD5 or SHA-1. I'm wondering security of HMAC which is based on weak hash function If there are key k, message m Hmac(k,m) =...
1
vote
1answer
287 views

Is this implementation of PBKDF2 correct?

I am preparing for a presentation and I just want to double check that I've got it right: PBKDF2 is: for (0,4096) { data1 = HMACSHA1(data1, data2); data2 = HMACSHA1(data2, data1); } ...
4
votes
1answer
819 views

SSL/TLS CipherSuite TLS_NULL_WITH_NULL_NULL

CipherSuite TLS_NULL_WITH_NULL_NULL means no encryption no mac Then why it is standardized?What for? And popular browser and Server support it?
1
vote
2answers
159 views

Ensuring integrity of broadcast messages between known network nodes

I need to share data between N network nodes in a given network. The N network nodes are all mine, but apart from them it is possible for any device to connect to the same network. There is no master ...
2
votes
2answers
319 views

Finding hash collision

for instance, sha-1 is known as weak hash function. If attacker finds collision in hash function, can he generate valid MAC for given message m? I mean it is possible to generate valid mac for any ...
1
vote
1answer
2k views

Is there any MAC like hmac-sha2-256-96 mac in openssh?

I used this command $ ssh username@ip_addr -m hmac-sha2-256-96 but I got this message: unknown type mac Is there any MAC like this or is it really not valid?
8
votes
1answer
2k views

Why isn't Amazon using a NONCE for REST Authentication?

When you look at Amazons RESTAuthentication you can see that it doesn't use a nonce: Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature; Signature = Base64( HMAC-SHA1( ...
2
votes
1answer
4k views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide 33: ...
1
vote
2answers
1k views

Is encrypting a CRC with the plaintext ok?

We're using encrypt-then-mac for authenticated encryption, and recently added a CRC32 to the plaintext. Are there any security problems with using a non-authenticated hash mechanism (for example, ...
1
vote
3answers
920 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...
1
vote
0answers
515 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...
3
votes
2answers
1k views

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

My organization has a group policy that is applied to servers enforcing FIPS compliance (Windows AD policy). In .NET, HMACSHA1 is one of the encryption/hash algorithms that is FIPS compliant. I don't ...
1
vote
0answers
56 views

Is my current implementation of message signing on AVR sufficient and correct?

I am currently implementing a fairly simple signing library (for my personal use) to verify the identity of packets sent with the RF24Mesh library (using NRF24L01+) radios. Never made a flowchart but ...
3
votes
1answer
52 views

Is it necessary to sanitize data being passed into the hash_hmac in php?

I have a page that takes in arguments that could possibly be changed by a malicious user. I am checking to make sure that the contents have not been unexpectedly changed by using HMAC. In php, there ...
3
votes
2answers
420 views

Securing ASP.net web api (REST) [closed]

I am developing a middle-ware web service app (REST) using ASP.net MVC-4 web API. The rest services are consumed by android, ios, angularjs client apps. The same user is able to use multiple ...
1
vote
0answers
542 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
1
vote
1answer
2k views

How can an attacker downgrade/modify the cipher suites when they are MACed? (Freak, Logjam use downgrade attacks)

In the Finished handshake of TLS all previous messages exchanged are sent from the client to the server (and reverse) and protected by a MAC. This is what also "prevents" TLS_FALLBACK_SCSV from being ...
2
votes
1answer
777 views

Is secret key for HMAC in form of UTF8 characters good enough?

There is a popular JWT library on nuget. I am analyzing an application that uses that library and it stores a secret key as a string. In the code of the library I see that it uses the MS HMACSHA256 ...
1
vote
1answer
590 views

Why is HMAC truncated in IPsec?

I'm having a look at IPsec standard and I realized that integrity and data authentication check is based on 96-bit truncated version of HMAC algorithms. For example, in IPsec v3 we can use HMAC-MD5-96,...
6
votes
2answers
499 views

HMAC with or without data encryption?

I'm in the process of developing a system that periodically transmits a small amount of data (16/18 bytes), where the only part that will change is a 4 byte counter that will increment for each ...
3
votes
1answer
78 views

Proper secret key management

Right now, I'm thinking that for all incoming requests, my server will check the token of the request against the token constructed from my app's global secret key for authenticity. The only way for ...
2
votes
1answer
3k views

How and when is a MAC sent across during a TLS connection?

I have been trying to get my head around the MAC part of the TLS connection as both the key exchange and cipher seem to make sense. As far as I understand the MAC is used to ensure that the ...
3
votes
2answers
2k views

Client certificate vs HMAC

My team is working on web API project for one customer which will call this API. Now we are thinking about authentication. We've stopped on two options HMAC and client certificates HMAC: pros - no ...
4
votes
0answers
100 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
2
votes
1answer
97 views

Is D parameter of the RSA strong enough to be used as secret for HMAC calculation?

Short question: Is the D parameter of the RSA alghorithm crypthographically strong enough to be used as a secret key for generating SHA-256 hash value? Long question: I'm working on windows platform. ...
4
votes
1answer
587 views

cracking krb5 passwords (des3-hmac-sha1 and des-cbc-crc ) [closed]

I'm trying to audit kerberos passwords. The available formats are des3-hmac-sha1 and des-cbc-crc but I cannot find a possibility/a tool to crack them. For other hash-types I used John the Ripper, but ...
2
votes
1answer
108 views

Why include the host in the signature of the Amazon HMAC scheme?

The Amazon's HMAC schemes includes the hash of the canonical request in the string to sign in order to create the signature, and the canonical request in turn includes the host. What is the security ...
0
votes
2answers
598 views

should I add a sha256 signature to an AES_256_CBC encrypted token?

currently I generate a token for an mobile app the way below. I decrypt the token to process the request and assess the user is logged in. I'm on TLS RSA 2048 bits connection. I was wondering if $...
0
votes
3answers
105 views

does validating MAC of individual packets validates the integrity of whole file?

When transferring a large file over network, its likely that the file is broken into packets and then transferred. The underlying network protocol, lets consider the case of TLS/SSL, it generates MACs ...