Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
24 votes
Accepted

JWT: Choosing between HMAC and RSA

HMAC is used to prevent manipulation by someone who does not have access to the secret. Typically this means preventing manipulation by the client if the secret is only known to the server or to ...
Steffen Ullrich's user avatar
22 votes

What are requirements for HMAC secret key?

According to RFC 7518 - JSON Web Algorithms (JWA): A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This ...
jordanbtucker's user avatar
13 votes
Accepted

Shared secret when using JWT with an HMAC for authentication

"Shared secret" in this case typically means between multiple servers, not between the client and the server. Typically, JWTs can be done using symmetric encryption - in which case all servers that ...
crovers's user avatar
  • 6,381
13 votes

How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?

Important Disclaimer: I wrote CipherSweet for my employer. Everything that follows should be taken with a grain of salt unless otherwise verified by third party security experts. Even if this answer ...
Scott Arciszewski's user avatar
10 votes

Detect duplicates without exposing underlying data

I think you're not too far from a possible solution (aka using a modern KDF and effectively treating this like a password). However, there are some more considerations (which were already mentioned ...
Conor Mancone's user avatar
9 votes
Accepted

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

"FIPS compliance" is about more than the algorithm. It is about implementations. Being awarded the "compliant" badge is a long, complex and very expensive process; its conceptual meaning is that there ...
Tom Leek's user avatar
  • 173k
9 votes

Password Hashing: add salt + pepper or is salt enough?

Just a BTW, the new NIST Digital Idendity Guidelines (Draft) strongly recommend to use Pepper as well: https://pages.nist.gov/800-63-3/sp800-63b.html#sec5 5.1.1.2 Memorized Secrets Verifier: ......
eckes's user avatar
  • 982
8 votes
Accepted

How vulnerable is IPSec HMAC-SHA1

For preventing interception and reading of the secret content, encryption algorithms like AES are used. HMACs do not matter at all for this part. Assuming AES (CBC etc.) is secure, an attacker ...
deviantfan's user avatar
  • 3,844
8 votes

Why would I use MAC over digital signature?

Performance alone is a reason to use MAC. Consider a TLS connection. For every packet, the receiving party needs to verify that the packet wasn't modified in transit by a man-in-the-middle attacker. ...
Gilles 'SO- stop being evil''s user avatar
8 votes
Accepted

Why aren’t collisions important with HMAC?

From RFC 2104 § 6 describing the security requirements for an HMAC: The security of the message authentication mechanism presented here depends on cryptographic properties of the hash function H: ...
forest's user avatar
  • 66.8k
7 votes

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

There are two different notions of compliance here: Using a compliant algorithm — the official term is “Approved”. Hash algorithms for HMAC are Approved if they are listed in FIPS 180-4 (or earlier ...
Gilles 'SO- stop being evil''s user avatar
7 votes
Accepted

Is this vault-less password manager/generator design safe?

The master key must be a sufficiently long, randomly-generated key. It must be at least 16 bytes generated uniformly at random (not 16 random printable ASCII characters and definitely not a human-...
Gilles 'SO- stop being evil''s user avatar
7 votes
Accepted

HMAC and key size

An HMAC is a very simple construction. You could have come up with it yourself, except that HMAC is standardised which means that a lot of people looked at it and found it to be resistant against ...
Luc's user avatar
  • 32.9k
6 votes

Is it safe to use HMAC with a public key for the purpose of salting?

The username (Or user id) is not a proper salt. Salts should be unique for each combination of username+password, that means if the user changes the password the salt should change too The salts ...
Mr. E's user avatar
  • 1,964
6 votes

Using Hashcat to crack HMAC-SHA256

The file format is MAC:message, as @atom already mentioned. By "MAC" I mean the value the HMAC produces, a.k.a. the hash, so the MAC comes first and then the message that this MAC is signing....
Luc's user avatar
  • 32.9k
6 votes

How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?

Disclaimer: while I looked into the design and implementation of ciphersweet back when it was published (or at least when I became aware of it), I didn't perform a full-blown audit & proof of ...
nicoo's user avatar
  • 411
6 votes

HMAC and key size

You might want to take a look at the RFC 2104: Definition of HMAC The definition of HMAC requires a cryptographic hash function, which we denote by H, and a secret key K. We assume H to be a ...
Euphrasius von der Hummelwiese's user avatar
6 votes

JWT: Choosing between HMAC and RSA

See the longer answer on recommended algorithm for JWT, the one line answer is to go with RS256 (RSA 2048 bits with SHA 256). JWT tokens support a few signature schemes, mainly: RSA (RS256), ECDSA (...
user5994461's user avatar
  • 1,296
5 votes
Accepted

SSL/TLS CipherSuite TLS_NULL_WITH_NULL_NULL

TLS_NULL_WITH_NULL_NULL is specified and is the initial state of a TLS connection during the first handshake on that channel, but must not be negotiated, as it provides no more protection than an ...
Yorick de Wid's user avatar
5 votes
Accepted

Why is CBC-MAC insecure for variable length input?

In its plain form, CBC-MAC is vulnerable to "length extension attack", where you just add some blocks at the end. So in order to stop people from doing that, you need to somehow mark the final block ...
StackzOfZtuff's user avatar
5 votes

How to perform in-browser signing of data with Javascript using HMAC-SHA512?

There are many client side librarys out there, that are able to create HMAC signatures (google can help you here). For example jsSHA, which can also be found on cdnjs. Explainations on how to use the ...
125_m_125's user avatar
  • 151
5 votes
Accepted

How is HMAC better than MAC?

HMAC is an implementation of MAC. MAC is just a name given to tools that authenticate messages. HMAC is the name of an implementation of a MAC system using hash functions. So there is no better one ...
MiaoHatola's user avatar
  • 2,294
5 votes

Using Hashcat to crack HMAC-SHA256

The syntax is hash:message Note that the length of the message is limited to 51 bytes. See hashcat example wiki page for details.
atom's user avatar
  • 181
5 votes
Accepted

Is appending a salt before hash generation enough

You do not need to salt in HMAC, per my best understanding. Salting prevents rainbow tables of common hashed things - in the case of passwords, this is because there are lots of people with the same ...
crovers's user avatar
  • 6,381
5 votes
Accepted

HMAC-SHA256 for JWT Token Signature

HMAC and password hashing solve very different problems. With HMAC the secret is expected to be high quality (ie 128 bits of entropy), whereas passwords are expected to be low quality (30 bits of ...
AndrolGenhald's user avatar
5 votes

when should i use HMAC-based JWT?

You have a server which has a secret key. You want to give another party some type of claim (for example, you could give a user a token saying they're authenticated), so you sign it and hand the ...
Shruggie's user avatar
  • 249
4 votes
Accepted

Is encrypting a CRC with the plaintext ok?

I wouldn't do this and don't understand what problem you are trying to solve (unless this is a purely academic question). Encrypt-then-MAC where we define ciphertext=encrypt(K_enc, msg) and sending ...
dr jimbob's user avatar
  • 39.4k
4 votes

Theoretical - Password salting with concatenation vs. salting with HMAC

The four methods you listed are essentially equivalently secure for the purpose of hashing passwords. The HMAC construction of H(k1 ++ H(k2 ++ m)) (where ++ is concatenation) is designed ...
dr jimbob's user avatar
  • 39.4k
4 votes

Security tokens for external exposure: UUID or HMAC/JWT/hash?

I see a few concerns with what you've described: Depending on how you generate the UUIDs, they may not be all that unpredictable -- they're not cryptographically strong tokens. You do not describe a "...
David's user avatar
  • 16.1k

Only top scored, non community-wiki answers of a minimum length are eligible