Skip to content

Instantly share code, notes, and snippets.

@mimoo

mimoo/MAC.md

Last active May 8, 2019 04:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mimoo/58893bbbffe4c0cb2375c741cc84c03f to your computer and use it in GitHub Desktop.
Save mimoo/58893bbbffe4c0cb2375c741cc84c03f to your computer and use it in GitHub Desktop.
Download ZIP
history of mac
Raw
MAC.md

Message Authentication Codes

  • why is it called MAC?

MACs seems to be used for:

  • authentication and integrity
  • randomness, if used as a PRF (not all MACs are PRFs, HMAC is)
  • key derivation, if used as a PRF in a KDF (HKDF)

Bad Algorithms

Whereas the basic CBC MAC is only secure on messages of one fixed length (and that length must be a multiple of the block size), CMAC takes and is secure across messages of any bit length. CMAC is a variant of the mode called XCBC that was invented and analyzed by John Black and Phillip Rogaway. It enjoys provable-security, with the conventional bounds.

  • one-time MACs like GMAC, Poly1305

Good Algorithms

  • SHA-256(k || m || k) is proven to be secure
    • whereas SHA-256(k || m) is vulnerable to length-extension attacks
  • HMAC = HASH(k1 || HASH( k2 || m))
    • NMAC is defined with HMAC, but requires modification to the underlying hash function so nobody uses it
    • Dan Boneh on HMAC
  • KMAC = SHAKE(k || padding || m) for Keccak-MAC is defined in FIPS 180
  • siphash seems to be good/fast with short inputs

Standards

History

Security Properties

  • HMAC needs an iterated hash function?
  • they are resistant to authentication tag forgery
  • PRFs are MACs, but the reverse is not always true.
    • having said that, HMAC, KMAC and Siphash are all considered PRF

Usage

Authentication in TLS. HMAC is used to authenticate the transcript and to derive keys in HKDF. There's also the NULL ciphers in TLS which is basically an authenticated but non-encrypted session.

Symmetric Authentication in Time-Based One-Time Password (TOTP). TOTP(key, time) = HMAC(key, time) where time is in seconds but incremented as to keep the same value for some period of time (60s for example)

Symmetric Authentication in HMAC-Based One-Time Password (HOTP). HOTP(key, counter) = HMAC(key, counter)

Integrity of Cookies. To track user browser sessions you can send them a random string (associated to their metadata) OR send them the metadata directly attached with an authentication tag so that they can't modify the metadata. Google has pushed this to the limit with Macaroons

Authentication/Authorization/Access Tokens. Same thing as cookies. This is used in JWT, SAML, OAUTH, OpenID, SSO, etc. I don't think it is great practice though as asymmetric primitives like signatures would be better.

to check:

  • Global Platform/ISO 7816 Secure Messaging, which uses C-MAC.
  • snmp
  • borg backup
  • ipsec-ah
  • s3 authentication
  • encryption is forbidden on HAM bands
  • macaroons
  • bip32
  • hawk
  • oauth 1.0

Other Papers

incomplete list

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment