HMAC using a static key is a bad idea?

Thinking loud:

Encrypting a CRC with a static key seems to me a BAD idea: The original CRC
is computable and since always the same key is used, this key is eventually
retrievable. We need a changing key with limited life-span.

If we XOR (or do another fast operation to create a new key with) this
static HMAC-key with the dynamic key in use, and use the result to encrypt
the CRC, the HMAC-key will have the same protection as the main key. Or does
this give away the dynamic key? My guess is that such an operation must be
irreversible to be safe.

Can anybody spend some ammunition on this?

__________________________________________________
Hans Steegers



--
Message sent by the [email protected] mailing list.
Unsubscribe: mail [email protected], "unsubscribe cipe-l" in body
Other commands available with "help" in body to the same address.
CIPE info and list archive: <URL:http://sites.inka.de/~bigred/devel/cipe.html>