Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction.

What I don't understand is, how or why is HMAC_SHA256(message,key) safer (in terms of resistant against certain attacks) than SHA256(key1+message+key2), assuming that all key strings are sufficient in length and entropy?

share|improve this question
HMAC_SHA256(message,key) has a security proof; we do not have a ready-made one for SHA256(key1+message+key2). That's quite an argument. That said, for reasons similar to HMAC_SHA256, SHA256(key1+message+key2) intuitively seems quite strong: there's a key1 initially, making collision hard; then a final key2, further increasing security. However the lack of alignment to block boundary in SHA256(key1+message+key2) makes it quite hard to devise a proof. –  fgrieu Mar 20 '14 at 20:19
@fgrieu : $\:$ (I realize it's been over a year, but) One could consider SHA256(key1+message+padtoblockboundary+key2) instead. $\;\;\;\;$ –  Ricky Demer Apr 6 at 21:03

1 Answer 1

Some research brought up this paper. The authors state that it's possible to significantly reduce the claimed security so that the security is about the same as collision resistance instead of preimage resistance. The details can be read there and in the references.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.