A quick question. Are there any problems with the following HMAC use-case:
We have two entities ($A$ and $B$), both of them have a secret ($A$ has $S_0$ and $B$ has $S_1$)
$A$ generates a random value $r$ and calculates the following tag: $t=HMAC(S_0,r)$
$A$ then sends $(r,t)$ to $B$.
$B$ calculates $t' = HMAC(r,S_1)$.
If the comparison $t' = t$ is true, does that imply that $S_0 = S_1$?
We are flipping the HMAC use-case around, instead of checking the authenticity of our message $r$, we are implying the reverse. And because HMAC is provable bound to the pre-image properties of the underlying hash, if the hash is secure, so is this use-cause (I did not write any formal reasoning or so, but my feeling is that if this is not true, then the security of the HMAC is not true).
Note that this is not true for encryption functions (mac then encrypt). CCA2 and ciphertext indistinguishability rule this use-case out (encryption is no authentication). But HMAC is an authentication scheme.
I just thought of this, so maybe I'm looking over something trivial.