Keying Hash Functions for Message Authentication

By Mihir Bellare, Ran Canetti, Hugo Krawczyk. 1996

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Riffle (2016, methodology): “A client only uploads a ciphertext of layered authenticated encryption of size b + mλ, where b is the size of the message, m is the number of servers, and λ is the size of the message authentication codes (MACs) [8] used with the authenticated encryption [9].”
Verifying computations with state (2013, methodology): “As a compromise, we instantiate a simple scheme using HMAC-SHA2564 [10] (see Appendix C [21] for details).”
Cryptographic Extraction and Key Derivation: The HKDF Scheme (2010, methodology): “In this section we first describe an abstract KDF that implements the extract-then-expand approach discussed throughout this paper, and then specify an instantiation solely based on HMAC [9].”
Securing wireless sensor networks: a survey (2008, background): “In a general approach, the sender concatenates a message M with the shared key K and then computes a MAC C = H(M||K), where H() is a collision-resistant hash function [82].”
The Security of the Cipher Block Chaining Message Authentication Code (2000, methodology): “Amongst the many proposed methods we mention XOR-MACs [6], HMAC [5] and UMAC [9].”
Foundations of Cryptography: Volume 1, Basic Tools (2001, unknown): “For discussion of message-authentication schemes (MACs) the reader is referred to [15].”
Scalable and efficient provable data possession (2008, background): “Other even more practical constructions of PRFs deployed in standards use ”good” MAC functions, such as HMAC [18].”
XMSS - A Practical Forward Secure Signature Scheme based on Minimal Security Assumptions (2011, methodology): “In [2] it is assumed, that the compression function of a good M-D hash function is a pseudorandom function family if keyed using the input.”
Packet leashes: a defense against wormhole attacks in wireless networks (2003, methodology): “In unicast communication, (point-to-point) nodes can use message authentication codes for authentication: the sender S and receiver R must share a secret key K, which they use in conjunction with a message authentication code function (for example HMAC [4]) to authenticate messages they exchange.”
A Sanctuary for Mobile Agents (2001, result): “The idea of a Partial Result Authentication Code (PRAC) is very similar to that of a message authentication code (MAC)[2, 1 0 , 1 1 ].”
PriPeARL: A Framework for Privacy-Preserving Analytics and Reporting at LinkedIn (2018, methodology): “gth extension attack and potential collisions, it may be desirable to avoid keyed hashing and instead use a cryptographically secure and unbiased hash function such as HMAC with SHA-256 (HMAC-SHA256) [7]. This factor needs to be weighed against the computational e˝ciency requirements, which could fa”
Achieving Efficient Conjunctive Keyword Searches over Encrypted Data (2005, methodology): “We chose to instantiate f using HMAC-SHA1 [6].”
Password-Based Authenticated Key Exchange in the Three-Party Setting (2005, unknown): “Possible choices are the HMAC [2] or the CBC MAC.”
Secure Indexes (2003, methodology): “In practice, we use the keyed hash function HMAC-SHA1 : { 0 , 1 ∗ × { 0 , 1 160 → { 0 , 1 160 [1] as the pseudo-random function f , which allows z-idx to handle arbitrary length words.”
FPGA Intrinsic PUFs and Their Use for IP Protection (2007, background): “Furthermore, this is true for any deterministic MAC such as [4,3,24].”
Pseudorandom Functions: Three Decades Later (2017, background): “Pseudorandom functions fit naturally into message authentication and in particular underlie the security of the widely deployed authentication function HMAC [22, 21].”
A Block-Cipher Mode of Operation for Parallelizable Message Authentication (2002, background): “For example, one could begin with breaking the message M [1] · · ·M [2m] into M′ = M [1]M [3] · · ·M [2m − 1] and M ′′ = M [2]M [4] · · ·M [2m] then separately MAC each half.”