Hot answers tagged

15

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC definition implies this. Indeed, it clearly does not. So, conceptually, you need a pseudorandom function. You can assume that HMAC is a pseudorandom function. It is ...


3

Like Yehuda Lindell already wrote, MAC does not imply PRF, which is pretty much what you would want from a KDF. Additionally, some of your assumptions are not correct: A key and data as input and an output that has the same length as the input key; This is frequently not the case with MACs. For example, when you use any MAC based on AES-256 (...


1

The commit that added this double HMAC only says it improves "valid MAC detection", but it simultaneously adds the constant-time comparison, so likely the reason is indeed defense against timing attacks: Improve valid MAC detection Implement constant time string comparison as well as double HMAC verification for encryption MACs. Double HMAC is a ...



Only top voted, non community-wiki answers of a minimum length are eligible