# Is HMAC-MD5 considered secure for authenticating encrypted data?

I've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash.

Does that mean that something like HMAC-MD5 still might be considered safe for authenticating encrypted data?

-
Collisions are irrelevant in typical MAC usage scenarios. – CodesInChaos Jul 20 '13 at 12:24
Somewhat relevant crypto.stackexchange.com/a/6753/5231 – rath Jul 20 '13 at 12:31
@CodesInChaos does that mean that HMAC-MD5 is secure for use in an encrypt-then-mac scheme? – Nuoji Jul 20 '13 at 15:04
– Maarten Bodewes Jan 23 at 13:55

Yes, there are currently no known attacks on HMAC-MD5.

In particular, after the first collision attacks on MD5, Mihir Bellare (one of the inventors of HMAC) came up with a new security proof for HMAC that doesn't require collision resistance:

"Abstract: HMAC was proved by Bellare, Canetti and Krawczyk (1996) to be a PRF assuming that (1) the underlying compression function is a PRF, and (2) the iterated hash function is weakly collision-resistant. However, recent attacks show that assumption (2) is false for MD5 and SHA-1, removing the proof-based support for HMAC in these cases. This paper proves that HMAC is a PRF under the sole assumption that the compression function is a PRF. This recovers a proof based guarantee since no known attacks compromise the pseudorandomness of the compression function, and it also helps explain the resistance-to-attack that HMAC has shown even when implemented with hash functions whose (weak) collision resistance is compromised. We also show that an even weaker-than-PRF condition on the compression function, namely that it is a privacy-preserving MAC, suffices to establish HMAC is a secure MAC as long as the hash function meets the very weak requirement of being computationally almost universal, where again the value lies in the fact that known attacks do not invalidate the assumptions made."

However, this does not mean you should use HMAC-MD5 in new cryptosystem designs. To paraphrase Bruce Schneier, "attacks only get better, never worse." We already have practical collision attacks for MD5, showing that it does not meet its original security goals; it's possible that, any day now, someone might figure out a way to turn those into a preimage attack, which would compromise the security of HMAC-MD5. A much better choice would be to use HMAC with a hash function having no known attacks, such as SHA-2 or SHA-3.

-

Ilmari Karonen's answer is correct when HMAC is used for its intended purpose, but that doesn't mean that HMAC is completely unaffected by MD5's collisions:

Given a specific Key, note that K xor opad and K xor ipad are independent of the message m. This means that any collision in H((K xor ipad) || m) will result in a colliding HMAC, even with two different messages.

For HmacMd5, K xor ipad would be 64 bytes long. So if you find two messages m1 and m2 with at least a 64 byte common prefix pre, you can calculate a key K = pre xor ipad that will create a collision between H((K xor ipad) || m1) and H((K xor ipad) || m2), leading to a complete collision in the whole HMAC.

This can be exploited two ways:

• You don't trust the person that generated the key, and HMAC is being misused as a sort of checksum.
• An attacker gains access to the key, and can use MD5's chosen prefix attack to cause collisions.

But as the accepted answer states, if the key is secret and controlled by you or trusted parties, HmacMd5 is still secure.

-
Yes, there was already this kind of answer until it got deleted. The question explicitly states "for authenticating encrypted data". The use for calculating checksums and the availability of the key are perpendicular to that part of the question. Welcome to crypto anyway, these kind of well written answers are very welcome here! – Maarten Bodewes Jan 23 at 13:44
I agree, however this information will be useful to a lot of people arriving on this page and it does not give incorrect information with respect to the initial question. It states clearly hmacmd5 is still secure if used correctly. – George Powell Jan 23 at 13:47
You can create a separate question, e.g. "When is HMAC-MD5 not considered secure?" and self-answer it if you like. It would be on topic that way (I haven't looked for dupes yet). Then you can always point to it from a comment under the question. – Maarten Bodewes Jan 23 at 13:49
Okay thank you. I'll do this when I have a spare minute. – George Powell Jan 23 at 13:51
Sorry, that was my previous comment as well: see Q/A here – Maarten Bodewes Jan 23 at 13:52