I mean something like a NIST, ISO, FIPS or similar standard which defines a constructions for a PRF.

  • $\begingroup$ Keccak has a build in keyed mode, but I'm not sure if NIST standardized it as part of SHA-3. $\endgroup$ Feb 9, 2017 at 13:55
  • $\begingroup$ @CodesInChaos NIST standardized KMAC (keyed SHA-3) as part of SP 800-185 (PDF). $\endgroup$
    – SEJPM
    Feb 9, 2017 at 16:00

2 Answers 2


HMAC is the standard way to construct a PRF from a hash function.

(Unfortunately the above standards only describe it as a MAC, not as a PRF)

It's also very popular in practice. For example it's used in SSL/TLS, SSH, HOTP/TOTP.

I recommend using it with SHA-2 as the underlying hash function. Though technically the known weaknesses of MD5 and SHA1 don't apply to keyed use in HMAC, so even those obsolete hashes could still be used as PRF in the HMAC construction.

  • 2
    $\begingroup$ For MD5 and SHA1 "could still be used" actually means: If you have them in a system, there is no need to panic. For new development: Don't use them. $\endgroup$
    – tylo
    Feb 9, 2017 at 17:51

@CodesInChaos already mentioned HMAC, so I won't repeat it. I'll add, however:

  • NIST 800-38B specifies CMAC, a block cipher mode that can be used as a variable input length MAC or PRF.
  • There are several standardized variants of the CBC-MAC which might be provably PRFs, but CBC-MAC is hard to use right—CMAC is likely a safer choice.

Rogaway's "Evaluation of Some Blockcipher Modes of Operation" is a very useful survey of all of these (HMAC, CMAC and CBC-MAC variants), that mentions which ones are NIST, ISO and ANSI standards, summarizes results about their security and provides a good bibliography as well.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.