4 ms·
It's not unreasonable, although in the case of SHA-3 (Keccak), it's recommended to use KMAC. It pads the key and adds a domain separation prefix. Unlike HMAC, t
by xeeeeeeeeeeenu 3y ago
It's not unreasonable, although in the case of SHA-3 (Keccak), it's recommended to use KMAC. It pads the key and adds a domain separation prefix. Unlike HMAC, there's no double hashing.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-185.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
- espadrine 3y agoI’ve seen recommendations to use HopMAC (roughly H(key, customization=H(message))), to thwart differential power analysis, reducing the need for protection to the shorter outer call: https://www.reddit.com/r/crypto/comments/llaqim/comment/go1w9dl/ https://www.reddit.com/r/crypto/comments/llaqim/comment/go1w...
- gnabgib 3y agoKangaroo12(K12) is a reduced-round KECCAK(aka SHA3) hash. Their HopMAC recommendation is only for K12 (and presumably Marsupilami14), not general purpose like HMAC (it's also quite similar to HMAC[0]). There's also KMAC[1] which is based on full-round KECCAK, avoiding the double hash. HopMAC(K,M)=H(K || H(M)) HMAC(K,M)=H(K || H(K || M)) [0]: https://datatracker.ietf.org/doc/draft-irtf-cfrg-kangarootwelve/ https://datatracker.ietf.org/doc/draft-irtf-cfrg-kangarootwe... [1]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-185.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...