If the attacker doesn't have the key, he will have to bruteforce the full hash and not just 9999 values. Or what is the different use here? The root post was referring to storing hashes and not passwords (better to store HMACs and not hashes).
I don't know of any attack. However, my point is just that HMAC means using hashing for a message authentication code. Encrypting hashes makes more sense as to what's going on.
Comments
If the attacker doesn't have the key, he will have to bruteforce the full hash and not just 9999 values. Or what is the different use here? The root post was referring to storing hashes and not passwords (better to store HMACs and not hashes).
There is a difference between a HMAC and encrypting a hash, or a HMAC and a salted a hash.
HMAC means Hash based Message Authentication Code.
http://en.wikipedia.org/wiki/HMAC
I thought HMAC was equivalent to an encrypted hash.
From that link:
HMAC(K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)).
Why would HMAC be inappropriate in this case (of storing user credentials)? Is there a vulnerability?
HMAC(key, password) instead of hash(password) or hash(salt+password)
I don't know of any attack. However, my point is just that HMAC means using hashing for a message authentication code. Encrypting hashes makes more sense as to what's going on.