I was reading about HMAC and why it is crucial to avoid security issues with normal prepending / appending the secret k to a message (issues due to merkel damagard construction). I am not familiar with the math and the detailed proof presented in the paper, but i was wondering why both ipad and opad are required. what if we use only one ? how will an attacker exploit that ?

  • 1
    $\begingroup$ We could always replace one of the constants with 0, and the other with ipad ⊕ opad; all this would do is permute the keyspace. $\endgroup$ Commented Apr 15, 2015 at 21:53


Browse other questions tagged or ask your own question.