26
votes
Accepted
JWT: Choosing between HMAC and RSA
HMAC is used to prevent manipulation by someone who does not have access to the secret. Typically this means preventing manipulation by the client if the secret is only known to the server or to ...
- 205k
22
votes
What are requirements for HMAC secret key?
According to RFC 7518 - JSON Web Algorithms (JWA):
A key of the same size as the hash output (for instance, 256 bits for
"HS256") or larger MUST be used with this algorithm. (This
...
- 320
13
votes
Accepted
Shared secret when using JWT with an HMAC for authentication
"Shared secret" in this case typically means between multiple servers, not between the client and the server. Typically, JWTs can be done using symmetric encryption - in which case all servers that ...
- 6,381
13
votes
How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?
Important Disclaimer: I wrote CipherSweet for my employer. Everything that follows should be taken with a grain of salt unless otherwise verified by third party security experts. Even if this answer ...
10
votes
Detect duplicates without exposing underlying data
I think you're not too far from a possible solution (aka using a modern KDF and effectively treating this like a password). However, there are some more considerations (which were already mentioned ...
- 31.5k
9
votes
Password Hashing: add salt + pepper or is salt enough?
Just a BTW, the new NIST Digital Idendity Guidelines (Draft) strongly recommend to use Pepper as well:
https://pages.nist.gov/800-63-3/sp800-63b.html#sec5
5.1.1.2 Memorized Secrets Verifier:
......
- 982
8
votes
Accepted
How vulnerable is IPSec HMAC-SHA1
For preventing interception and reading of the secret content, encryption algorithms like AES are used. HMACs do not matter at all for this part.
Assuming AES (CBC etc.) is secure, an attacker ...
- 3,864
8
votes
Why would I use MAC over digital signature?
Performance alone is a reason to use MAC.
Consider a TLS connection. For every packet, the receiving party needs to verify that the packet wasn't modified in transit by a man-in-the-middle attacker. ...
8
votes
Accepted
Why aren’t collisions important with HMAC?
From RFC 2104 § 6 describing the security requirements for an HMAC:
The security of the message authentication mechanism presented here depends on cryptographic properties of the hash function H: ...
- 67.1k
7
votes
Accepted
Is this vault-less password manager/generator design safe?
The master key must be a sufficiently long, randomly-generated key. It must be at least 16 bytes generated uniformly at random (not 16 random printable ASCII characters and definitely not a human-...
7
votes
Accepted
HMAC and key size
An HMAC is a very simple construction. You could have come up with it yourself, except that HMAC is standardised which means that a lot of people looked at it and found it to be resistant against ...
- 33.1k
6
votes
Is it safe to use HMAC with a public key for the purpose of salting?
The username (Or user id) is not a proper salt. Salts should be unique for each combination of username+password, that means if the user changes the password the salt should change too
The salts ...
- 1,964
6
votes
Using Hashcat to crack HMAC-SHA256
The file format is MAC:message, as @atom already mentioned. By "MAC" I mean the value the HMAC produces, a.k.a. the hash, so the MAC comes first and then the message that this MAC is signing....
- 33.1k
6
votes
How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?
Disclaimer: while I looked into the design and implementation of ciphersweet back when it was published (or at least when I became aware of it), I didn't perform a full-blown audit & proof of ...
- 411
6
votes
HMAC and key size
You might want to take a look at the RFC 2104:
Definition of HMAC
The definition of HMAC requires a cryptographic hash function, which we denote by H, and a secret key K. We assume H to be a ...
6
votes
JWT: Choosing between HMAC and RSA
See the longer answer on recommended algorithm for JWT, the one line answer is to go with RS256 (RSA 2048 bits with SHA 256).
JWT tokens support a few signature schemes, mainly: RSA (RS256), ECDSA (...
- 1,296
5
votes
Accepted
SSL/TLS CipherSuite TLS_NULL_WITH_NULL_NULL
TLS_NULL_WITH_NULL_NULL is specified and is the initial state of a TLS
connection during the first handshake on that channel, but must not be
negotiated, as it provides no more protection than an ...
- 3,398
5
votes
How to perform in-browser signing of data with Javascript using HMAC-SHA512?
There are many client side librarys out there, that are able to create HMAC signatures (google can help you here). For example jsSHA, which can also be found on cdnjs. Explainations on how to use the ...
- 151
5
votes
Accepted
How is HMAC better than MAC?
HMAC is an implementation of MAC.
MAC is just a name given to tools that authenticate messages.
HMAC is the name of an implementation of a MAC system using hash functions.
So there is no better one ...
- 2,304
5
votes
Using Hashcat to crack HMAC-SHA256
The syntax is hash:message
Note that the length of the message is limited to 51 bytes.
See hashcat example wiki page for details.
- 181
5
votes
Accepted
Is appending a salt before hash generation enough
You do not need to salt in HMAC, per my best understanding. Salting prevents rainbow tables of common hashed things - in the case of passwords, this is because there are lots of people with the same ...
- 6,381
5
votes
Accepted
HMAC-SHA256 for JWT Token Signature
HMAC and password hashing solve very different problems. With HMAC the secret is expected to be high quality (ie 128 bits of entropy), whereas passwords are expected to be low quality (30 bits of ...
- 15.8k
5
votes
when should i use HMAC-based JWT?
You have a server which has a secret key. You want to give another party some type of claim (for example, you could give a user a token saying they're authenticated), so you sign it and hand the ...
- 249
4
votes
Theoretical - Password salting with concatenation vs. salting with HMAC
The four methods you listed are essentially equivalently secure for the purpose of hashing passwords.
The HMAC construction of H(k1 ++ H(k2 ++ m)) (where ++ is concatenation) is designed ...
- 39.5k
4
votes
Security tokens for external exposure: UUID or HMAC/JWT/hash?
I see a few concerns with what you've described:
Depending on how you generate the UUIDs, they may not be all that unpredictable -- they're not cryptographically strong tokens.
You do not describe a "...
- 16.1k
4
votes
Decoding a HMAC SHA256 when the key is the same as the original string
How easy would it be for someone to decrypt this, knowing that the original message equals the key?
If all you know is that they key equals the message, then attacking the HMAC practically impossible....
- 205k
4
votes
Accepted
Is HMAC preferable to Digital signature
They're suitable for different use cases. Assuming you're using a well-tested implementation written by somebody who knows what they're doing (so, probably not something you wrote yourself or pulled ...
- 50.3k
4
votes
Accepted
Can I use PBKDF2 derivation function to generate a MAC in PKCS12 file?
NO. (sorry)
Actually you need all of B not just B.2, and if you try to implement this note the formulas in B.2 step 6 have errors; see https://www.rfc-editor.org/errata_search.php?rfc=7292 .
See ...
4
votes
Which one to use AES : GCM vs CBC
First of all, your actual risks determined the need for confidentiality, integrity, and authentication. The risks can be deletion of rows, insertion of rows, altering cells, or the rollback of the ...
- 5,569
Only top scored, non community-wiki answers of a minimum length are eligible