Quote from: willphase on September 26, 2013, 02:51:17 AM

Quote from: Dabs on September 26, 2013, 02:12:53 AM

I'm challenged because I don't know how to explain it. I'm trying to say that while the pattern fits and looks random, it is predictably random.

HMAC is predictable - that's the whole point of a message authentication code, if it was truly random it wouldn't be much use!

However, it appears random (and for all extends and purposes is random) if you don't know the secret and the input changes each time, even by 1 bit.

Will

Disclaimer: cryptography is not my strong point

So, I don't exactly understand what you're saying. HMAC is based on hashing. What you're saying is that all cryptographic hashing just 'appears random', which sounds very low to me. I thought the randomness of cryptography hashes was quite strong.

Also, isn't the HMAC just doing something to a hash? So the underlying security of the hash is still there.