Linked Questions

39 votes
2 answers
59k views

Why is HMAC-SHA1 still considered secure?

This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
user93353's user avatar
  • 2,245
11 votes
2 answers
5k views

Is HMAC-MD5 still secure for commitment or other common uses?

MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash ...
mikeazo's user avatar
  • 38.7k
9 votes
1 answer
3k views

Is HMAC-SHA-1 secure?

Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
BlaX's user avatar
  • 736
7 votes
2 answers
553 views

Is calculating HMAC from hashed input a good idea?

The original HMAC algorithm is as follows: H(K XOR opad || H(K XOR ipad || text)) What if text would replaced with H(text)? ...
psorobka's user avatar
6 votes
1 answer
4k views

Is PBKDF2/RFC 2898 broken because SHA1 is broken?

I was attempting to re-implement the ASP.NET Identity password hash algorithm in PHP. It uses RFC 2898, which uses HMAC SHA1. SHA1 has been broken by google. Does this mean that RFC 2898 in general ...
Justin Dearing's user avatar
5 votes
1 answer
584 views

Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?

As we know, MD5 and SHA1 (to some extent) are broken, and older algorithms like SHA0 or MD4 and MD2 are very broken. Does this also imply that the corresponding HMACs are also broken? Obviously nobody ...
RocketNuts's user avatar
  • 1,387
10 votes
1 answer
805 views

How does a preimage attack on MD5 break the security of HMAC-MD5?

It was mentioned in an answer to a different question that it's possible that, any day now, someone might figure out a way to turn those into a preimage attack, which would compromise the ...
Elias's user avatar
  • 4,923
2 votes
2 answers
2k views

Is HMAC necessary if the AES ciphertext of a message includes the CRC of the message?

I've seen that encrypting an image with AES-CBC then calculating the HMAC-MD5 value for authentication is a somewhat common and sound way to secure data. Alternatively, can I just calculate the CRC of ...
Trevor's user avatar
  • 31
11 votes
1 answer
690 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
chris000r's user avatar
  • 519
2 votes
1 answer
818 views

Is this DIY remote lock protocol secure?

I need your advice on following scheme of exchange protocol between remote lock and key. I'm planning to use following algorithm: Key generates unique value that never repeats (in reality it's just ...
Ruslan's user avatar
  • 23
1 vote
1 answer
502 views

Why does NaCl's crypto_auth have twice the security level of crypto_onetimeauth?

The crypto_auth function produces a 256-bit HMAC, with a 512-bit version also available. But the crypto_onetimeauth function (...
Jack O'Connor's user avatar
1 vote
1 answer
473 views

Is it okay to reuse a single symmetric key for a large volume of messages and HMACs, so long as "nonces" are randomly generated for both of them?

https://www.reddit.com/r/crypto/comments/fnku50/nonce_reuse_vs_iv_reuse/ Nonce reuse with the same key is catastrophic to security. The same premise holds for initialization vectors. If the key ...
cyborg's user avatar
  • 69