for instance, sha-1 is known as weak hash function. If attacker finds collision in hash function, can he generate valid MAC for given message m? I mean it is possible to generate valid mac for any message , just using weak hash function. If it possible, what is needed to generate valid mac?

  • I'm guessing you're talking about HMACs, and if so, no, finding a collision in a hash function isn't enough to generate a valid HMAC - you would need a collision between a hash, and that hash prepended with a specific other string, which you don't always know.
    – Matthew
    Sep 5, 2016 at 16:05

2 Answers 2


The prefixing hash collision vulnerabilities found in MD5 and SHA-1 do not undermine the security of an HMAC.

To put it simply: The security of the HMAC is dependent on a secret key and generating a collision isn't a shortcut. The attacker cannot generate the intended valid HMAC without knowledge of this secret key K- nor any other message input that would lead to the same output (e.g. a collision).

Additionally, the vulnerability found in MD5 and SHA-1 are prefixing attacks, and an attacker cannot control the prefix of the hash used in an HMAC due to an XOR operation, as shown in the diagram below:

enter image description here

  • That diagram is somehow harder to follow than HMAC(K, m) = H((K ⊕ opad) || H((K ⊕ ipad) || m)).
    – forest
    Jun 19, 2018 at 6:21

No, because the key acts as a bias adding just enough entropy to defeat the weakness. In the same way you can also still use HMACs based on md5. Obviously you shouldn't do so.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .