Hugo Krawczyk

In 1996 Krawczyk, Mihir Bellare and Ran Canetti showed how to turn an ordinary hash function into a message authentication code without inheriting its weaknesses. The result was HMAC, published as RFC 2104 the following year, and it outlived both MD5 and SHA-1 because its security proof asks less of the hash than collision resistance. In 2010 came HKDF, an extract-then-expand design for key derivation that now forms the backbone of TLS 1.3, Signal and WireGuard.

His SIGMA protocol from 2003 sits under the signature modes of IKE for IPsec and shaped the TLS 1.3 handshake. HMQV, from 2005, set off a long and unusually acrimonious argument about what security proofs actually prove. Later he co-designed OPAQUE, in which the server never sees the password, not even at registration.