3 ms·
HMAC's verify the integrity of a message; they don't have any use in this setting.
by Xk 16y ago
HMAC's verify the integrity of a message; they don't have any use in this setting.
- iwwr 16y agoIf the attacker doesn't have the key, he will have to bruteforce the full hash and not just 9999 values. Or what is the different use here? The root post was referring to storing hashes and not passwords (better to store HMACs and not hashes).
- Xk 16y agoThere is a difference between a HMAC and encrypting a hash, or a HMAC and a salted a hash. HMAC means Hash based Message Authentication Code. http://en.wikipedia.org/wiki/HMAC http://en.wikipedia.org/wiki/HMAC
- iwwr 16y agoI thought HMAC was equivalent to an encrypted hash.
- Xk 16y agoFrom that link: HMAC(K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)).
- iwwr 16y agoWhy would HMAC be inappropriate in this case (of storing user credentials)? Is there a vulnerability? HMAC(key, password) instead of hash(password) or hash(salt+password)
- Xk 16y agoI don't know of any attack. However, my point is just that HMAC means using hashing for a message authentication code. Encrypting hashes makes more sense as to what's going on.