# Is using the same key for different message HMACs insecure?

When using the MAC-then-Encrypt composition, would using the same key for the HMAC in each different message be insecure?

No, with a reasonable choice of hash function, HMAC can safely authenticate many messages under the same key—it is not a one-time MAC like GHASH or Poly1305. Of course, it may be prudent to use a message sequence number so you can reject replays (and it may be necessary for your encryption scheme, e.g. if you're using AES-CTR or ChaCha).

That said, why are you making this decision instead of using an authenticated cipher like AES-GCM or NaCl crypto_secretbox_xsalsa20poly1305?

• The reason for not an authenticated encryption mode is I agree with Colin Percival's opinion on those - which you probably know. Also, I use SHA3_256 as my hash. – Legorooj Oct 26 '19 at 0:59
• If you're referring to Colin Percival's ‘cryptographic right answers’, that was written over a decade ago before authenticated ciphers like AES-GCM and crypto_secretbox_xsalsa20poly1305 were widely available. (What he called ‘CWC’ in his expanded note is a predecessor to GCM, and NaCl had just been released the year prior.) His point about side channel attacks is relevant for AES-GCM in software; not so much for crypto_secretbox_xsalsa20poly1305. – Squeamish Ossifrage Oct 26 '19 at 1:13
• Side note: There is essentially no technical reason to ever use SHA3-256 for anything because its kind of goofy parameters were chosen for political rather than technical reasons, and no reason to use HMAC with SHA-3 when you can use KMAC128 instead. – Squeamish Ossifrage Oct 26 '19 at 1:14
• Ok then - he links to an article that is more up-to-date and he mentions gcm in that. Anyway, the associated data is a nuisance in my program, and HMACs serve me better. What is your recommended hash? – Legorooj Oct 26 '19 at 1:19
• If associated data is a nuisance then just…don't use it. You can safely pass in an empty string as the associated data. For authenticated encryption, I recommend NaCl crypto_secretbox_xsalsa20poly1305 (unless you have constraints—which you don't seem to have—to use US federal government standards, in which case AES-GCM). If you really really want to use SHA-3, just use KMAC128 with a 128-bit output. If for some reason you have some of SHA-3 but not KMAC, SHAKE128(key ∥ msg) with 256-bit key and 128-bit output is perfectly fine as a MAC too. – Squeamish Ossifrage Oct 26 '19 at 1:35