When Messages are Keys: Is HMAC a dual-PRF?

ePrint Report: When Messages are Keys: Is HMAC a dual-PRF?

Matilda Backendal, Mihir Bellare, Felix Günther, Matteo Scarlata

In Internet security protocols including TLS 1.3, KEMTLS, MLS and Noise, HMAC is being assumed to be a dual-PRF, meaning a PRF not only when keyed conventionally (through its first input), but also when "swapped" and keyed (unconventionally) through its second (message) input. We give the first in-depth analysis of the dual-PRF assumption on HMAC.


For the swap case, we note that …

eprint report input internet internet security keys messages noise protocols report security tls tls 1.3