Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? What is the attacker calculating?

share|improve this question
The article on this subject is Kim, Biryukov, Preneel, and Hong's paper, On the Security of HMAC and NMAC Based on HAVAL, MD4, MD5, SHA-0 and SHA-1. – David Schwartz Apr 12 '12 at 9:25
up vote 17 down vote accepted

Actually, HMAC might still be secure for a hash function that is broken (with respect to the requirements of a cryptographic hash function, such as primary preimage resistance, secondary preimage resistance and collision resistance), but it must not be too badly broken. If you read the original paper, you see that the authors assume things such as the hash function being "weakly collision resistant", or more precisely that the inner hash function is collision resistant only to adversaries that see the hash value only after it being hashed again with a different secret key.

Also, since HMAC, contrary to NMAC, doesn't use two independent keys, but a single key that is combined with two different pads using XOR, additional assumption about the pseudo randomness of the hash function are made.

I believe MD4 does not even meet these weaker assumptions, and that is why HMAC-MD4 is considered to be broken, while e.g. HMAC-MD5 is not (yet).

share|improve this answer
That said, new implementations should probably default to something like HMAC-SHA2 out of an abundance of caution. – Stephen Touset Apr 9 '13 at 22:56
It may be worth noting that the security argument for HMAC has been improved with a refined argument asking for somewhat weaker properties than in the original proof. – fgrieu Apr 11 '13 at 5:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.