0
$\begingroup$

Not sure about the security implications of making HMAC SHA1 message and corresponding hash public (secret would remain… secret)?

Evaluating if that would help an attacker crack algorithm.

Improve this question
$\endgroup$
1
  • $\begingroup$ What's trying to be kept secret? Without the key, an attacker will not be able to produce the tag/hash. When you do Encrypt-then-MAC, the message (the ciphertext) and tag are public. $\endgroup$
    – samuel-lucas6
    Sep 1, 2022 at 17:26

1 Answer 1

Reset to default
3
$\begingroup$

No, HMAC is using a one way hash in a construction that avoids length extension attacks. But even without that: the key is only used as input to a one way hash algorithm. So getting the value of the key should be impossible if you have any set of input message and HMAC output.

To "crack the algorithm" you'd need to analyze the algorithm. But if you do that an attacker can just use their own set of inputs / outputs, including any key. Having the output just helps with verifying that the key would be correct. HMAC should be secure regardless.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.