# Does the ability to influence the key of a MAC effects its security?

If a PPT adversary can influence the key of a MAC function, is it still secure?

For example, if we define $$f$$ as follow:

$$f(r,x) = HMAC_{(k\oplus r)}$$(x)

If the adversary has oracle access to $$f$$, how likely he can predict the key $$k$$?

For respecting the persons who have answered the above question, I do not change it. The actual scenario is as follows:

I have a module that gets $$(m,r)$$ and generates $$(m,x,HMAC_{k \oplus r}(m \parallel x))$$ where the $$k$$ is the secret of the module and $$x$$ is the message added by the module. So:

$$f(m,r)=(m,x,HMAC_{k \oplus r}(m \parallel x))$$

Can I claim that every tuple $$(m,x,t)$$ s.t. $$t=HMAC_{k \oplus r}(m \parallel x))$$ is generated by the module?

P.S. I am still curious about the above claim. But, I just noticed that if I change $$f$$ as follows:

$$f(m,r)=(m,x,HMAC_k(m \parallel x \parallel r))$$

then, I can claim every tuple $$(m,x,t)$$ s.t. $$t=HMAC_k(m \parallel x \parallel r))$$ is generated by the according to the definition of MAC.

• What can $r$ depend on? – Maeher Oct 27 '19 at 9:36
• If an adversary has access to such an f, this is called related-key attack security. – SEJPM Oct 27 '19 at 11:23
• @Maeher $r$ is an arbitrary input – Reza Oct 27 '19 at 13:19
• When you say ‘HMAC’, do you really mean only HMAC (with an unspecified hash function) and not an arbitrary MAC? – Squeamish Ossifrage Oct 27 '19 at 15:35
• @MaartenBodewes Because in HMAC, the key $k$ is used once via $k \oplus \mathrm{ipad}$ and once via $k \oplus \mathrm{opad}$, which will interact rather easily with the pattern of related keys allowed, potentially leading to trouble. (Also see SEJPM's citation. on HMAC with related keys.) – Squeamish Ossifrage Oct 31 '19 at 16:32

If the adversary has oracle access to $$f$$, how likely he can predict the key $$k$$?
A more interesting question would be, if an attacker has access to (this concrete) $$f$$, how easy is it to forge tags? This has in fact been studied for HMAC and keys related by a constant leading to an attack that runs in time $$2^{n/2}$$ with $$n$$ being the HMAC's output length.