Can you exaplin what a "2nd preimage attack" is and how HMAC solves it?
If it's an attack you can do after the database is compromised it's not very interesting, and if it's an attack you can do over the wire then you can just limit the number of login attempts per some duration no?
There are numerous ways to accidentally introduce a weakness to 2nd preimage resistance. Using an HMAC is a way to “reset” the entropy of a hash key and eliminate any unwanted source of information leakage.
Comments
Can you exaplin what a "2nd preimage attack" is and how HMAC solves it?
If it's an attack you can do after the database is compromised it's not very interesting, and if it's an attack you can do over the wire then you can just limit the number of login attempts per some duration no?
I can try to explain, but this answer on the theoretical computer science stackexchange does it much better: https://cstheory.stackexchange.com/a/591
There are numerous ways to accidentally introduce a weakness to 2nd preimage resistance. Using an HMAC is a way to “reset” the entropy of a hash key and eliminate any unwanted source of information leakage.