4
$\begingroup$

I'm in a situation where I need to use HMAC-MD5 (for a learning, non-production application) and it needs to be collision-resistant.

So my question: Is HMAC-MD5 collision-resistant if the key is unknown, ie you are only given standard oracle access to an HMAC-MD5 oracle?

Alternatively, if possible you can replace "MD5" with "any Merkle-Damgård hash function for which collisions are known" (which is a more general statement).

Note that "Is HMAC-MD5 still secure for commitment or other common uses?", while related, only talks about the situation with a known key to the adversary.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

Yes, HMAC-MD5 with the key secret is still considered practically secure against all attacks, including collisions. We are about in the situation considered in Mihir Bellare's New Proofs for NMAC and HMAC: Security without Collision-Resistance (extended abstract in proceedings of Crytpto 2006).

But as the saying attributed to the NSA goes: attacks only get better; they never get worse.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.