Re: [Cfrg] HMAC-MD5

[michaelslists at gmail.com]

I thought that HMAC-MD5 was vulnerable if the key is known? That is,
the underlying function is still broken, so why risk it?

Key management is hardly easy, so there no reason to give it extra weight ?

-- Michael


On 3/29/06, Russ Housley <housley at vigilsec.com> wrote:
> At the SAAG session last week, Sam and I were asked about
> HMAC-MD5.  Is it safe to keep using it?  Should we encourage people
> to use HMAC-SHA1 or HMAC-SHA256 instead?  Why?
>
> Please provide advice on this matter in the next two weeks.  We have
> on working group that needs this advice very soon.
>
> Russ
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg at ietf.org
> https://www1.ietf.org/mailman/listinfo/cfrg
>

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg