Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 3 down vote favorite

The NIST recommended HMAC uses

$$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$

Is it feasible to analyze the security and efficiency with different hash function implementations for $H_\mathrm{in}$ and $H_\mathrm{out}$ for a single instance?

I would like to know whether it makes sense to use different hash functions for the same HMAC.

Thanks!

share|improve this question

1 Answer

up vote 4 down vote accepted

You may want to take a look at the original HMAC paper by Bellare, Canetti and Krawczyk (1996), or at the new security proof by Bellare (2006).

As far as I can tell at a glance, there's nothing in either of these proofs that would actually rely on the inner and outer hash functions being the same function, as long as both of them satisfy the appropriate security properties.

share|improve this answer
@limari: Bellare et. al. have remarked(Remark 4.6 from 1996 paper) that the use of combination hash functions.. 1. Can this atleast be argued from an efficiency(implementation) point of view, considering the fact that the strength of the security would be unaffected? 2. Also we can argue that collision resistance increases with increase in hash output size. So can there be an analysis from that direction? – Maverickgugu Apr 14 '12 at 9:52
@Maverickgugu: For collision resistance, the minimum of both hash output sizes counts. I don't really see how using two different functions can get faster than using just the faster one of them twice. – Paŭlo Ebermann♦ Apr 14 '12 at 14:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.