Hot answers tagged

6

In 2006, Mihir Bellare, in their article New Proofs for NMAC and HMAC: Security without Collision-Resistance proved that if the compression function is a PRF then HMAC is a PRF ( this is a short story, see below). As a result, HMAC like HMAC-MD5 does not suffer the weaknesses of MD5. However, still prefer HMAC-SHA256 or KMAC of the SHA-3 series. Keep ...


2

Linux uses "sha512crypt", which isn't memory-hard but is fine given a moderately strong input passphrase. HMAC-SHA256 isn't a password-hashing algorithm. It's not even a hash function. It requires a uniformly-random secret key which it uses on a message to produce a Message Authentication Code (tag) of that message under that key. The password-...


2

TLDR: (2) is a sufficient condition, but probably not a necessary condition. Most people would probably believe that HMAC-SHA-1 is indeed a PRF, although SHA-1 is not WCR. The 2006 paper by Bellare claims to prove that e.g. HMAC-SHA-1 is a PRF, if the inner compression function of SHA-1 is a PRF. No known attacks break the pseudorandomness of the inner ...


Only top voted, non community-wiki answers of a minimum length are eligible