Can we use two different hash functions in single hmac..for ex' for inner layer hash function md5 and for outer layer hash function sha1


This is exactly what was done in early versions of HMAC. Of course, there would be no reason to do this with an already broken hash function. Note that MD5 is completely broken and SHA1 is close to, so neither of these are great choices.

  • $\begingroup$ MD5-HMAC and SHA1-HMAC can still be used as MAC. Quoting RFC6151: The attacks on HMAC-MD5 do not seem to indicate a practical vulnerability when used as a message authentication code. ... Therefore, it may not be urgent to remove HMAC-MD5 from the existing protocols. However, since MD5 must not be used for digital signatures, for a new protocol design, a ciphersuite with HMAC-MD5 should not be included. $\endgroup$ – kludg Oct 7 '16 at 13:33
  • $\begingroup$ I haven't seen an early version of HMAC which used different hash function in the inner/outer layers; the original HMAC paper (Bellare et al) implied you use the same hash for both. Are you sure someone actually did that? $\endgroup$ – poncho Oct 7 '16 at 15:34
  • $\begingroup$ @poncho See tools.ietf.org/html/rfc6101: section F.1.5 for the design principle and section 6.2.2 for an exact description of the usage. In Sectin it is also hinted at but I wasn't sure without reading more details. $\endgroup$ – Yehuda Lindell Oct 8 '16 at 16:44
  • $\begingroup$ @kludg I am fully aware that there are no practical attacks on HMAC-MD5 or HMAC-SHA1. However, it is really not smart to use HMAC-MD5 today (MD5 is so broken that you our confidence in HMAC-MD5 is severely shaken, even if no attacks are currently known). Also, as you yourself quoted: if you are doing something new then you should certainly NOT use HMAC-MD5; I go further to say use HMAC-SHA256 and not even HMAC-SHA1. $\endgroup$ – Yehuda Lindell Oct 8 '16 at 18:22
  • $\begingroup$ @YehudaLindell: SSLv3 doesn't use separate hashes for the inner/outer HMAC computations; instead, section F.1.5 and section 6.2.2 is talking about the key derivation function, which really isn't HMAC at all. I don't know what you see as a 'hint' in section (which does talk about the SSLv3 variant of HMACs) $\endgroup$ – poncho Oct 16 '16 at 2:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.