0
$\begingroup$

I'm creating an application that requires message authentication on the payload of a QR-code. Because of the maximum length of an error-correcting (H) QR-code (368 bits) and the original size of my payload (128 bits), I have to limit the size of the MAC.

This leaves me with several options. I can use basically any HMAC variant, and cut the output to fit in the QR-code payload (I tried this with HMAC-SHA512) or I can use a potentially weak implementation with HMAC-MD5, which fits perfectly.

My question is: which of the proposed solutions is more secure?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

From RFC 6151:

new protocol designs should not employ HMAC-MD5.

Whilst HMAC-MD5 is currently not broken, that doesn't mean you should use it. It's 2022, and there are considerably better options.

I think anybody you ask on here would recommend truncated HMAC-SHA-256, truncated HMAC-SHA-512, or keyed BLAKE2/BLAKE3, which wouldn't need to be truncated. These provide a higher security margin, and nobody will question your protocol.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.