3 ms·
> HMAC keys are like AES keys: fully random; they should come from /dev/urandom. I've been using pwgen -s: based on /dev/urandom, but typeable. My understandin
by tlb 11y ago
> HMAC keys are like AES keys: fully random; they should come from /dev/urandom.
I've been using pwgen -s: based on /dev/urandom, but typeable. My understanding was that it first took a hash of the key, so as long as the total entropy was high it was fine for it to be ASCII.
- tptacek 11y agoSure. ASCII isn't the problem; structure is. You already know the attack: take a sample MAC (built with a very, very fast MAC function) and aim a permutating dictionary at it.