4 ms·

The collision attack on SHA-1 should not threaten HMAC-SHA1. Even HMAC-MD5 hasn't been successfully attacked yet, AFAIK. Poly1305 is arguably less misuse-resis

by tveita 13y ago

The collision attack on SHA-1 should not threaten HMAC-SHA1. Even HMAC-MD5 hasn't been successfully attacked yet, AFAIK. Poly1305 is arguably less misuse-resistant, since it requires a nonce.

tptacek 13y ago
That's typical of AEAD modes in general, though. GCM also requires a nonce.