The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed).

How does this relate to common assumptions for compressions functions? Is it required to show security of the Hash function? Conversely, can a good hash function have a weak compression function which is not a MAC?

This is of course related to my question about which compressions functions are PRFs.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.