Comment on BofA mails your PIN to the same address as the card it unlocksparentComments−Xk15yThere is a difference between a HMAC and encrypting a hash, or a HMAC and a salted a hash.HMAC means Hash based Message Authentication Code.http://en.wikipedia.org/wiki/HMAC−iwwr15yI thought HMAC was equivalent to an encrypted hash.−Xk15yFrom that link:HMAC(K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)).−iwwr15yWhy would HMAC be inappropriate in this case (of storing user credentials)? Is there a vulnerability?HMAC(key, password) instead of hash(password) or hash(salt+password)−Xk15yI don't know of any attack. However, my point is just that HMAC means using hashing for a message authentication code. Encrypting hashes makes more sense as to what's going on.
Comments
There is a difference between a HMAC and encrypting a hash, or a HMAC and a salted a hash.
HMAC means Hash based Message Authentication Code.
http://en.wikipedia.org/wiki/HMAC
I thought HMAC was equivalent to an encrypted hash.
From that link:
HMAC(K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)).
Why would HMAC be inappropriate in this case (of storing user credentials)? Is there a vulnerability?
HMAC(key, password) instead of hash(password) or hash(salt+password)
I don't know of any attack. However, my point is just that HMAC means using hashing for a message authentication code. Encrypting hashes makes more sense as to what's going on.