# Does the ability to influence the key of a MAC effects its security?

If a PPT adversary can influence the key of a MAC function, is it still secure?

For example, if we define $$f$$ as follow:

$$f(r,x) = HMAC_{(k\oplus r)}$$(x)

If the adversary has oracle access to $$f$$, how likely he can predict the key $$k$$?

For respecting the persons who have answered the above question, I do not change it. The actual scenario is as follows:

I have a module that gets $$(m,r)$$ and generates $$(m,x,HMAC_{k \oplus r}(m \parallel x))$$ where the $$k$$ is the secret of the module and $$x$$ is the message added by the module. So:

$$f(m,r)=(m,x,HMAC_{k \oplus r}(m \parallel x))$$

Can I claim that every tuple $$(m,x,t)$$ s.t. $$t=HMAC_{k \oplus r}(m \parallel x))$$ is generated by the module?

P.S. I am still curious about the above claim. But, I just noticed that if I change $$f$$ as follows:

$$f(m,r)=(m,x,HMAC_k(m \parallel x \parallel r))$$

then, I can claim every tuple $$(m,x,t)$$ s.t. $$t=HMAC_k(m \parallel x \parallel r))$$ is generated by the according to the definition of MAC.

• What can $r$ depend on? Commented Oct 27, 2019 at 9:36
• If an adversary has access to such an f, this is called related-key attack security. Commented Oct 27, 2019 at 11:23
• @Maeher $r$ is an arbitrary input
– Reza
Commented Oct 27, 2019 at 13:19
• When you say ‘HMAC’, do you really mean only HMAC (with an unspecified hash function) and not an arbitrary MAC? Commented Oct 27, 2019 at 15:35
• @MaartenBodewes Because in HMAC, the key $k$ is used once via $k \oplus \mathrm{ipad}$ and once via $k \oplus \mathrm{opad}$, which will interact rather easily with the pattern of related keys allowed, potentially leading to trouble. (Also see SEJPM's citation. on HMAC with related keys.) Commented Oct 31, 2019 at 16:32

If the adversary has oracle access to $$f$$, how likely he can predict the key $$k$$?
A more interesting question would be, if an attacker has access to (this concrete) $$f$$, how easy is it to forge tags? This has in fact been studied for HMAC and keys related by a constant leading to an attack that runs in time $$2^{n/2}$$ with $$n$$ being the HMAC's output length.