Hacker News Reader

Parent Full thread

Xk

There is a difference between a HMAC and encrypting a hash, or a HMAC and a salted a hash.

HMAC means Hash based Message Authentication Code.

http://en.wikipedia.org/wiki/HMAC

View on HN

I thought HMAC was equivalent to an encrypted hash.

From that link:

HMAC(K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)).

Why would HMAC be inappropriate in this case (of storing user credentials)? Is there a vulnerability?

HMAC(key, password) instead of hash(password) or hash(salt+password)

I don't know of any attack. However, my point is just that HMAC means using hashing for a message authentication code. Encrypting hashes makes more sense as to what's going on.

Reply on news.ycombinator.com