# DIfferent inner and outer hash functions for NIST Recommended HMAC?

The NIST recommended HMAC uses

$$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$

Is it feasible to analyze the security and efficiency with different hash function implementations for $H_\mathrm{in}$ and $H_\mathrm{out}$ for a single instance?

I would like to know whether it makes sense to use different hash functions for the same HMAC.

Thanks!

-

You may want to take a look at the original HMAC paper by Bellare, Canetti and Krawczyk (1996), or at the new security proof by Bellare (2006).

As far as I can tell at a glance, there's nothing in either of these proofs that would actually rely on the inner and outer hash functions being the same function, as long as both of them satisfy the appropriate security properties.

-
@limari: Bellare et. al. have remarked(Remark 4.6 from 1996 paper) that the use of combination hash functions.. 1. Can this atleast be argued from an efficiency(implementation) point of view, considering the fact that the strength of the security would be unaffected? 2. Also we can argue that collision resistance increases with increase in hash output size. So can there be an analysis from that direction? –  Maverickgugu Apr 14 '12 at 9:52
@Maverickgugu: For collision resistance, the minimum of both hash output sizes counts. I don't really see how using two different functions can get faster than using just the faster one of them twice. –  Paŭlo Ebermann Apr 14 '12 at 14:56