A password is a weak MAC key
02HMAC keys need enough entropy; a human-memorable password is not an appropriate substitute.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.5 ↗
RFC 8725 · § 3.5EXAMPLE
3 / 3
03
High-entropy key
Replace human-chosen passwords with suitable cryptographic key material.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A strong HMAC algorithm cannot repair a guessable symmetric key.
- A strong HMAC algorithm cannot repair a guessable symmetric key.
- Use keys with sufficient entropy for the selected algorithm.
- Protect private and symmetric keys from disclosure.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy