In some contexts (HKDF (RFC-5869 sec 2.2) and Bitcoin's BIP32 (master key generation)), I have seen the key and the data swapped for HMAC. E.g., let HMAC be a function $h:\{0,1\}^c \times \{0,1\}^b \to \{0,1\}^c$ (usual notation) defined for a key $k$ and data $m$ as $h(k, m)$. Well, some people let $k$ be a fixed public value (for instance, Bitcoin seed
), and encode secret bytes in $m$.
I understand why they would want to do this, for instance, the input material (that can be a secret key) can have any prescribed length $c$. I assume they do not expect integrity, they only want randomness.
I would expect security (or at least integrity) to depend on the secrecy of $k$ and properties on the underlying hash function. Indeed, using the results of Bellare's "New Proofs for NMAC and HMAC" 1, we do have a PRF as soon as the compression function of the hash function is a PRF, and if implementors did the right thing, this actually does not depend on the secrecy of $k$.
But it looks to me that the proof assumes a uniformly random, secret key. Does the PRF proof still hold if we reveal $k$ to the attacker?
(Note: This would be obvious if $k$ and $m$ played symmetrical roles in the HMAC construction - this is also not the case.)