Cryptography & Ciphers
GOST MAC Verifier
Check a GOST message-authentication code against its message and shared secret. A matching MAC does not identify its author.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
The verifier recalculates a shared-key MAC and compares it with the supplied value.
The result says “The signature matches” or “The signature does not match”. These labels describe a MAC comparison.
- Check a MAC produced by software that follows GOST R 34.13-2015.
Sources: RFC 8891: GOST R 34.12-2015 block cipher Magma; RFC 7801: GOST R 34.12-2015 block cipher Kuznyechik
Verify a known Magma MAC
Input: 92def06b3c130a59db54c704f8189d204a98fb2e67a8024c8912409b17b57e41
Settings: Key format Hex, Key ffeeddccbbaa99887766554433221100f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff, IV empty, MAC format Hex, MAC 154e7210, Input type Hex, and Algorithm GOST R 34.12 (Magma, 2015).
Result: The signature matches
GOST MAC Verifier reproduces the Magma MAC example from GOST R 34.13-2015. Change the last input byte from 41 to 40 and the result becomes “The signature does not match”.
Match the key, message, and MAC settings
- Set Input type to match the message representation.
- Enter the shared key and received MAC with their formats.
- Match Algorithm, sBox, and IV to the sender.
- A match does not identify which key holder wrote the message.
- The supplied MAC length controls comparison length. Short MACs provide weaker protection.
- An incorrect key length can return a mismatch instead of a validation error.