I am working for cryptography implementation in automotive industry.
I would always get request from various customer about using a symmetric key for AES encryption and HMAC generation.
It would be a great help if experts of cryptography suggest me in understanding this interference.
Hi Jayanthi Guruswamy
AES is used to provide confidentiality. HMAC is used to provide integrity. When we talk about infosec, both are very important. now as you said what could happen if we use same key for both aes and hmac, then let's say that attacker was able to crack the key then both confidentiality and integrity will be at risk. but if both are different, then we achieve anyone of them. let's say attacker got the AES key, then he/she will be able to see what is there in the information. He won't be able to change anything and it won't do any active demage. now, let's say that attacker got an hmac key, then he can just change the message and the integrity will be lost. it means that the message is not original and is tempered. it's a very big discussion, and based on requirements we can choose whether to use the same key or different key. I hope it will help.
No, there is no interference if the same symmetric key is used to perform AES encryption and HMAC generation.
AES encryption and HMAC generation are two separate cryptographic operations that can be performed independently of each other. AES encryption is used to encrypt data while HMAC is used to authenticate data.
Both operations use the same symmetric key, but they use the key in different ways. AES encryption uses the key to encrypt the data, while HMAC uses the key to generate a message authentication code (MAC) for the data.
In fact, it is common practice to use the same key for both encryption and authentication, as it simplifies key management and can improve performance. However, it is important to ensure that the key is kept secret and that it is not compromised, as this could allow an attacker to both decrypt the data and generate valid HMACs.
Hi!
If you want to use the same key for encryption and MAC you should implement some of the AEAD modes of operations from ISO/IEC 19772:2020. For example, you can select AES-GCM. But if you need AES and HMAC the best choice is to use a separate keys for these operations as Krunalkumar Shah explained.
Mathivilasini Dr.S - Thank you.
I would like to extend my question.
How does using a same key can improve performance ?
Nikolay Shenets - Thank you.
Yes, ideally it is recommended to either derive a key for AES and HMAC separately and then use it or AEAD mode.
Jayanthi Guruswamy As you know that if you use symmetric key encryption then performance will be much faster than the one which you can see in asymmetric key. the factor which can be compromised is the security.
If you use the same key then you need to transfer it only once and you need less space as well as the computation can also be reduced. Hence, it increases the performance.
- Badges
- Science topic