3
$\begingroup$

Within RFC 2104 section 3 there is discussion around keys (below). How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute keys?

"Keys need to be chosen at random (or using a cryptographically strong pseudo-random generator seeded with a random seed), and periodically refreshed. (Current attacks do not indicate a specific recommended frequency for key changes as these attacks are practically infeasible. However, periodic key refreshment is a fundamental security practice that helps against potential weaknesses of the function and keys, and limits the damage of an exposed key.)"

$\endgroup$

1 Answer 1

8
$\begingroup$

How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute keys?

The answers to those questions are beyond the scope of the RFC. So, it depends on the context in which HMAC is being used. The keys can be agreed upon/distributed in any secure manner. The RFC doesn't care. It could be via asymmetric crypto, it could be in person, it could be via carrier pigeon (if that is considered secure in your threat model).

$\endgroup$
3
  • $\begingroup$ Interesting...so it sounds like it really depends on how one wants to implement depending on security requirements. Are there any documented examples/use cases where all the concatenated cryptographic functions are laid out from end to end? $\endgroup$ Mar 28, 2016 at 15:19
  • $\begingroup$ @juantonamela TLS and SSH. $\endgroup$
    – mikeazo
    Mar 28, 2016 at 15:42
  • 3
    $\begingroup$ HMAC is also frequently used in situations that don't require key distribution, e.g. a server using HMAC to sign tokens and validate the signatures later. The key could be generated on the server and never leave it. $\endgroup$
    – cjm
    Mar 28, 2016 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.