Hot answers tagged

84 votes

How and when do I use HMAC?

HMAC is a computed "signature" often sent along with some data. The HMAC is used to verify (authenticate) that the data has not been altered or replaced. Here is a metaphor: You are going to mail a ...
user avatar
  • 941
62 votes

What's the difference between HMAC-SHA256(key, data) and SHA256(key + data)

Yes, HMAC is more complex than simple concatenation. As a simplistic example, if you were to simply concatenate key + data, then "key1"+"data" yields identical results to "key"+"1data", which is ...
user avatar
54 votes

How and when do I use HMAC?

The short answer is "HMAC provides digital signatures using symmetric keys instead of PKI". Essentially, if you don't want to deal with complexities of public/private keys, root of trust and ...
user avatar
  • 671
53 votes
Accepted

What are requirements for HMAC secret key?

I've added my answer here as I feel the existing ones don't directly address your question enough for my liking. Let's look at RFC 4868 (regarding IPSec, however it covers the HMAC-SHA256 function you ...
user avatar
43 votes
Accepted

When to use HMAC alongside AES?

AES is encryption; it is meant to maintain confidentiality. Encryption does not maintain integrity by itself: an attacker who can access encrypted data can modify the bytes, thereby impacting the ...
user avatar
34 votes

What's the difference between HMAC-SHA256(key, data) and SHA256(key + data)

There's actually a very big problem with SHA256(key||data): SHA-256, along with SHA-512, SHA-1, MD5, and all other hashes using the Merkle–Damgård construction, is vulnerable to a length extension ...
user avatar
  • 7,193
25 votes

Timing attack against HMAC in authenticated encryption?

It allows for the potential of an existential forgery. An attacker can create a valid HMAC for a chosen message without knowing the HMAC key. Basically, the way the attack works is this: The ...
user avatar
  • 35.5k
23 votes

What are requirements for HMAC secret key?

According to RFC 7518 - JSON Web Algorithms (JWA): A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This ...
user avatar
19 votes
Accepted

Why does node.js scrypt function use HMAC this way?

I created the Node Scrypt module. HMAC adds additional security. Using it also lends the scheme to be used as a header in an encrypted file format (like it is done in tarsnap) and not just in an ...
user avatar
17 votes
Accepted

Timing attack against HMAC in authenticated encryption?

The risk is that an attacker can forge data. In other words, they can come up with their own ciphertext and then figure out the expected HMAC to make your system accept the input as valid. The whole ...
user avatar
  • 4,024
16 votes
Accepted

Using RSA-SHA as/instead HMAC in OpenVPN?

Looking at OpenVPN's source code, this appears to be a cosmetic quirk of OpenSSL. When using --show-digests, OpenVPN calls OpenSSL's EVP_get_digestbynid() with, as parameter, all integers from 0 to ...
user avatar
15 votes
Accepted

JWT: Choosing between HMAC and RSA

HMAC is used to protect against manipulation by someone who has not access to the secret. Typically this means to protect against manipulation by the client if the secret is only known to the server ...
user avatar
13 votes

How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?

Important Disclaimer: I wrote CipherSweet for my employer. Everything that follows should be taken with a grain of salt unless otherwise verified by third party security experts. Even if this answer ...
user avatar
12 votes
Accepted

Is there a method to get plain-text from cipher-text in HMAC SHA-1, given that the key is known?

Nope Generally speaking: No. Hashing is not encryption. Hashing is not reversible. At all. It always generates a fixed length output. So with an output fixed to say 32 characters, and an input of 33 ...
user avatar
12 votes

What are requirements for HMAC secret key?

The RFC 2104 defining HMAC functions answers this question: The key for HMAC can be of any length (keys longer than B bytes are first hashed using H). However, less than L bytes is strongly ...
user avatar
11 votes
Accepted

Shared secret when using JWT with an HMAC for authentication

"Shared secret" in this case typically means between multiple servers, not between the client and the server. Typically, JWTs can be done using symmetric encryption - in which case all servers that ...
user avatar
  • 6,311
10 votes

Detect duplicates without exposing underlying data

I think you're not too far from a possible solution (aka using a modern KDF and effectively treating this like a password). However, there are some more considerations (which were already mentioned ...
user avatar
9 votes

Password Hashing: add salt + pepper or is salt enough?

Just a BTW, the new NIST Digital Idendity Guidelines (Draft) strongly recommend to use Pepper as well: https://pages.nist.gov/800-63-3/sp800-63b.html#sec5 5.1.1.2 Memorized Secrets Verifier: ......
user avatar
  • 962
8 votes
Accepted

Client certificate vs HMAC

Overall, I would recommend HMAC unless you have particular requirements for client certificates. The reasons are: Expiry While it is true that there is no mandatory expiry with HMAC, in reality, you ...
user avatar
  • 2,141
8 votes
Accepted

How vulnerable is IPSec HMAC-SHA1

For preventing interception and reading of the secret content, encryption algorithms like AES are used. HMACs do not matter at all for this part. Assuming AES (CBC etc.) is secure, an attacker ...
user avatar
  • 3,854
8 votes

Why would I use MAC over digital signature?

Performance alone is a reason to use MAC. Consider a TLS connection. For every packet, the receiving party needs to verify that the packet wasn't modified in transit by a man-in-the-middle attacker. ...
user avatar
8 votes
Accepted

Why aren’t collisions important with HMAC?

From RFC 2104 § 6 describing the security requirements for an HMAC: The security of the message authentication mechanism presented here depends on cryptographic properties of the hash function H: ...
user avatar
  • 64.2k
7 votes
Accepted

FIDO, U2F Compatibility

Per the Yubikey FAQ they state the following: ..."All YubiKey NEO devices manufactured as of February 10, 2015 supported the current FIDO U2F specification for NFC. To verify you have a YubiKey NEO ...
user avatar
  • 14.1k
7 votes
Accepted

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

"FIPS compliance" is about more than the algorithm. It is about implementations. Being awarded the "compliant" badge is a long, complex and very expensive process; its conceptual meaning is that there ...
user avatar
  • 169k
7 votes
Accepted

Is this vault-less password manager/generator design safe?

The master key must be a sufficiently long, randomly-generated key. It must be at least 16 bytes generated uniformly at random (not 16 random printable ASCII characters and definitely not a human-...
user avatar
7 votes
Accepted

HMAC and key size

An HMAC is a very simple construction. You could have come up with it yourself, except that HMAC is standardised which means that a lot of people looked at it and found it to be resistant against ...
user avatar
  • 31.9k
6 votes

Major industry password leaks using salted HMAC but without eg PBKDF2, scrypt

Perhaps it's also important to point out the breaches that have occurred where there was no evidence of compromised data. LastPass, for example, used "5,000 rounds of PBKDF2-SHA256" and a random salt (...
user avatar
  • 782
6 votes

Is it safe to use HMAC with a public key for the purpose of salting?

The username (Or user id) is not a proper salt. Salts should be unique for each combination of username+password, that means if the user changes the password the salt should change too The salts ...
user avatar
  • 1,954
6 votes

Using Hashcat to crack HMAC-SHA256

The file format is MAC:message, as @atom already mentioned. By "MAC" I mean the value the HMAC produces, a.k.a. the hash, so the MAC comes first and then the message that this MAC is signing....
user avatar
  • 31.9k
6 votes

How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem?

Disclaimer: while I looked into the design and implementation of ciphersweet back when it was published (or at least when I became aware of it), I didn't perform a full-blown audit & proof of ...
user avatar
  • 411

Only top scored, non community-wiki answers of a minimum length are eligible