4 ms·
So okay, if you're using HMAC where the user can provide the HMAC, this would be an issue (like session cookies), but it the user can only provide preimage (as
by _asummers 9y ago
So okay, if you're using HMAC where the user can provide the HMAC, this would be an issue (like session cookies), but it the user can only provide preimage (as in e.g. encrypting database column and wanting lookup) then this wouldn't be an issue, I don't think.
- bitexploder 9y agoYes. In situations where a hash is modifiable by the user and you do string comparison the issue exists. It isn't solely a problem for MACs.