The NIST recommended HMAC uses

$$\operatorname{HMAC}_k(\mathrm{text}) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \mathbin\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \mathbin\| \mathrm{text}) )$$

Is it feasible to analyze the security and efficiency with different hash function implementations for $H_\mathrm{in}$ and $H_\mathrm{out}$ for a single instance?

I would like to know whether it makes sense to use different hash functions for the same HMAC.


1 Answer 1


You may want to take a look at the original HMAC paper by Bellare, Canetti and Krawczyk (1996), or at the new security proof by Bellare (2006).

As far as I can tell at a glance, there's nothing in either of these proofs that would actually rely on the inner and outer hash functions being the same function, as long as both of them satisfy the appropriate security properties.

  • $\begingroup$ @limari: Bellare et. al. have remarked(Remark 4.6 from 1996 paper) that the use of combination hash functions.. 1. Can this atleast be argued from an efficiency(implementation) point of view, considering the fact that the strength of the security would be unaffected? 2. Also we can argue that collision resistance increases with increase in hash output size. So can there be an analysis from that direction? $\endgroup$ Commented Apr 14, 2012 at 9:52
  • $\begingroup$ @Maverickgugu: For collision resistance, the minimum of both hash output sizes counts. I don't really see how using two different functions can get faster than using just the faster one of them twice. $\endgroup$ Commented Apr 14, 2012 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.