Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently studying for an exam and this was a previous question:

Give one advantage of using HMACs over using RSA to sign SHA-1 hashes.

My thoughts are that it has something to do with the fact that HMAC assumes a private key has already been shared so there is no need to use public-private keys. But wouldn't it be possible for this key to be compromised?

share|improve this question
Advantages of HMAC are speed, as stated in the fine answers; and small size of the authenticating token (128 bits or even much less, vs at least 1024 bits). The obvious drawback of HMAC is that one needs a secret to verify that token. – fgrieu Apr 3 '13 at 6:45
up vote 8 down vote accepted

HMAC is much faster to compute. Also, HMAC might still be secure, even if the underlying hash function is broken. This is not true for RSA + a broken hash function.

share|improve this answer
"Will probably be must"? What about "are much"? Smaller size is certainly true as well. This is a dumb question though, it all depends on the key management... – Maarten Bodewes Apr 14 '12 at 16:08
@owlstead HMAC is much faster - RSA is a very slow algorithm – Owen Orwell Apr 2 '13 at 18:11
@OwenOrwell Sorry for the misunderstanding, that was about a typo in the answer, I'll edit it. – Maarten Bodewes Apr 2 '13 at 23:40

The main advantage is speed: HMACs are much faster than an RSA signature.

Given the question says you are signing SHA-1 hashes, there is no need to use a hash function in composition with RSA since the message will already be short-enough to sign directly. I doubt they are looking for an answer about the security of the underlying hash.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.