Comment on Using www-authenticate for user authenticationparentComments−catlifeonmars4yI can try to explain, but this answer on the theoretical computer science stackexchange does it much better: https://cstheory.stackexchange.com/a/591There are numerous ways to accidentally introduce a weakness to 2nd preimage resistance. Using an HMAC is a way to “reset” the entropy of a hash key and eliminate any unwanted source of information leakage.
Comments
I can try to explain, but this answer on the theoretical computer science stackexchange does it much better: https://cstheory.stackexchange.com/a/591
There are numerous ways to accidentally introduce a weakness to 2nd preimage resistance. Using an HMAC is a way to “reset” the entropy of a hash key and eliminate any unwanted source of information leakage.