3 ms·
Even if it's not required, the HMAC construction seem to generally make it much harder to exploit any weaknesses in the hash algorithm. For example SHA-1 is pre
by wongarsu 3y ago
Even if it's not required, the HMAC construction seem to generally make it much harder to exploit any weaknesses in the hash algorithm. For example SHA-1 is pretty broken by now, but HMAC-SHA1 has proven pretty resilient. (obviously don't use HMAC-SHA1, but it has hung on pretty well considering the state of SHA1)
- tptacek 3y agoAre we saying anything other than that preimage resistance on SHA1 has held up? Because that's true of MD5 too. It seems probable that H(k,m), for truncated H, will hold up? The big reason I can think of not to use H(k, m) (or hand-rolled SHA3 KMAC) is that it will quietly fail open if you switch to a normal SHA2 hash.