An Enhanced Hash-based Message Authentication Code using BCrypt

Many message authentication codes like HMAC depend on its underlying cryptographic algorithm. Unfortunately most of these algorithms are very fast that permits the attacker to easily establish a brute-force attack for key-retrieval. In this paper, it presents a method of solving the issue by applying BCrypt Expensive Key Setup function to derive the secret key of HMAC. As a result, the modification helps the algorithm to strengthen its resistance to exhaustive search and it protects against key recovery attacks. This work also presents results of comparing time-complexity in performing key-recovery attack for both original and modified version of HMAC.