6
In 2006, Mihir Bellare, in their article
New Proofs for NMAC and HMAC: Security without Collision-Resistance
proved that if the compression function is a PRF then HMAC is a PRF ( this is a short story, see below).
As a result, HMAC like HMAC-MD5 does not suffer the weaknesses of MD5. However, still prefer HMAC-SHA256 or KMAC of the SHA-3 series. Keep ...
2
Linux uses "sha512crypt", which isn't memory-hard but is fine given a moderately strong input passphrase.
HMAC-SHA256 isn't a password-hashing algorithm. It's not even a hash function. It requires a uniformly-random secret key which it uses on a message to produce a Message Authentication Code (tag) of that message under that key. The password-...
2
TLDR: (2) is a sufficient condition, but probably not a necessary condition. Most people would probably believe that HMAC-SHA-1 is indeed a PRF, although SHA-1 is not WCR.
The 2006 paper by Bellare claims to prove that e.g. HMAC-SHA-1 is a PRF, if the inner compression function of SHA-1 is a PRF. No known attacks break the pseudorandomness of the inner ...
Only top voted, non community-wiki answers of a minimum length are eligible
Related Tags
hmac × 535hash × 120
mac × 98
aes × 78
sha-256 × 55
encryption × 46
authentication × 46
authenticated-encryption × 39
pbkdf-2 × 30
keys × 28
signature × 23
key-derivation × 23
collision-resistance × 22
cbc × 22
sha-1 × 21
hkdf × 18
symmetric × 17
integrity × 16
md5 × 15
protocol-design × 14
ctr × 14
public-key × 13
gcm × 13
tls × 12
passwords × 12