Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?

  • 3
    $\begingroup$ cseweb.ucsd.edu/~mihir/papers/hmac-new.html $\;$ $\endgroup$
    – user991
    Commented Aug 10, 2014 at 23:19
  • 4
    $\begingroup$ The gist is that the HMAC construction has properties which allow its security definition to be met even if the hash used internally is not a cryptographic hash. It need only meet a weaker definition, which is why HMAC-MD5 is also still considered secure. $\endgroup$
    – pg1989
    Commented Aug 10, 2014 at 23:43

1 Answer 1


As shown in the paper Ricky Demer linked in the comments, HMAC can be secure even when the underlying hash function is not collision resistant. Only PRF-ness of the hash function is required, and SHA-1 is not known to lack it. Or a couple of other conditions can suffice even if it isn't a PRF.

Intuitively, it makes sense that HMAC is secure as a MAC even with SHA-1, because a MAC does not allow a collision search. The only way to find the key would be to compromise the preimage resistance of SHA-1. HMAC in turn prevents length extension attacks and the like that would allow a forgery without knowing the key.

As an aside, even HMAC-MD5 hasn't been broken. However, for the same reason as there – attacks only get better – I would recommend not choosing SHA-1 as the HMAC hash for new applications if you can just as easily use SHA-2.

  • 1
    $\begingroup$ You should update your answer. An attack on HMAC-MD5 has been found. $\endgroup$
    – mikeazo
    Commented May 11, 2015 at 1:53
  • $\begingroup$ @mikeazo AFAICT that doesn't seem to qualify as an attack after all? $\endgroup$
    – otus
    Commented May 16, 2015 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.