6
In 2006, Mihir Bellare, in their article
New Proofs for NMAC and HMAC: Security without Collision-Resistance
proved that if the compression function is a PRF then HMAC is a PRF ( this is a short story, see below).
As a result, HMAC like HMAC-MD5 does not suffer the weaknesses of MD5. However, still prefer HMAC-SHA256 or KMAC of the SHA-3 series. Keep ...
2
Linux uses "sha512crypt", which isn't memory-hard but is fine given a moderately strong input passphrase.
HMAC-SHA256 isn't a password-hashing algorithm. It's not even a hash function. It requires a uniformly-random secret key which it uses on a message to produce a Message Authentication Code (tag) of that message under that key. The password-...
2
TLDR: (2) is a sufficient condition, but probably not a necessary condition. Most people would probably believe that HMAC-SHA-1 is indeed a PRF, although SHA-1 is not WCR.
The 2006 paper by Bellare claims to prove that e.g. HMAC-SHA-1 is a PRF, if the inner compression function of SHA-1 is a PRF. No known attacks break the pseudorandomness of the inner ...
Only top voted, non community-wiki answers of a minimum length are eligible
