12
$\begingroup$

I am currently studying for an exam and this was a previous question:

Give one advantage of using HMACs over using RSA to sign SHA-1 hashes.

My thoughts are that it has something to do with the fact that HMAC assumes a private key has already been shared so there is no need to use public-private keys. But wouldn't it be possible for this key to be compromised?

Improve this question
$\endgroup$
1
  • $\begingroup$ Advantages of HMAC are speed, as stated in the fine answers; and small size of the authenticating token (128 bits or even much less, vs at least 1024 bits). The obvious drawback of HMAC is that one needs a secret to verify that token. $\endgroup$
    – fgrieu ♦
    Commented Apr 3, 2013 at 6:45

2 Answers 2

Reset to default
9
$\begingroup$

HMAC is much faster to compute. Also, HMAC might still be secure, even if the underlying hash function is broken. This is not true for RSA + a broken hash function.

Improve this answer
$\endgroup$
3
  • $\begingroup$ "Will probably be must"? What about "are much"? Smaller size is certainly true as well. This is a dumb question though, it all depends on the key management... $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 14, 2012 at 16:08
  • $\begingroup$ @owlstead HMAC is much faster - RSA is a very slow algorithm $\endgroup$
    – Owen Orwell
    Commented Apr 2, 2013 at 18:11
  • $\begingroup$ @OwenOrwell Sorry for the misunderstanding, that was about a typo in the answer, I'll edit it. $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 2, 2013 at 23:40
3
$\begingroup$

The main advantage is speed: HMACs are much faster than an RSA signature.

Given the question says you are signing SHA-1 hashes, there is no need to use a hash function in composition with RSA since the message will already be short-enough to sign directly. I doubt they are looking for an answer about the security of the underlying hash.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.