Collaborate Disseminate
I have a mobile app (iOS and Android) and I’m trying to implement HMAC with Node.js as the backend.
Currently I have a static shared key for symmetric HMAC(e.g. “ABC123”) which is hardcoded in both client (iOS and Android) a… Continue reading How to use public keys with asymmetric cryptography to dynamically create a shared secret for HMAC?
In a game client/server that I’m developing, I want to allow a user to authenticate over TLS (via a REST endpoint on an HTTPS server) before dropping to an unencrypted low-latency UDP protocol. To prevent spoofing and replay … Continue reading Can I securely share an HMAC key over a TLS connection?
I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API.
We realized that someone could then easily hook up to our API and make a clone that uses our API…. Continue reading How to protect HMAC key embedded in code from someone who would copy entire source?
Would the use of RSA-2048 signing be considered more secure than the use a MAC-algorithm with 256b keys?
Cannot including ‘@’ character or some local character like Japanese into hmac encryption data
$data = ‘version=1&cmd=create_transaction&key=xxxxxxxx&format=json&email=my.email@gmail.com’;
$hmac = hash_hmac… Continue reading Cannot including ‘@’ character into hmac encryption data
I am looking for a solution to storing SSNs in a secure way in a database.
The following references are related:
How to safely store sensitive data like a social security number?
https://paragonie.com/blog/2017/05/building… Continue reading Using HMAC for storing low-entropy input data (e.g. SSN)
When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a ‘fuzz-friendly mode’. For black-box protocol fuzzing this can not… Continue reading Is there a protocol fuzzer or fuzzing framework that uses cryptography?
Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following:
T = text, which is directly viewab… Continue reading How secure is using MD5 for signature
I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths.
Do we have to use a key with a fixed size in HMAC? If so, what is the key size? If not, why?
When I trie… Continue reading HMAC and key size
I’ve been trying to learn how HMAC is calculated but seem to be missing something. According to this wiki page, calling HMAC-SHA1 on an empty key and message should result in a value of fbdb1d1b18aa6c08324b7d64b71fb76370690e1d.
I’ve conf… Continue reading Calculating HMAC