Is the security of MAC function is based on HASH function It is widely known, generally, that a MAC is a HASH with key. I just want to ensure that my understanding is correct to avoid base further assumptions on wrong conception. So, if I used MAC that uses strong key but weak HASH such as MD-5. Does this means my MAC does not provide security and can be forged?
It is widely known, generally, that a MAC is a HASH with key.


Nope; there are plenty of perfectly good MACs that, if you know the key, aren't very good hashes at all.  Examples of this would include CMAC and GMAC; in both cases, if you know the key, it's easy to generate an image that MACs to a specific value.

However, lets assume that you're talking about HMAC specifically (which is a specific type of MAC based on a hash function).


  So, if I used MAC that uses strong key but weak HASH such as MD5. Does this means my MAC does not provide security and can be forged?


Depends on how weak the MAC is.  With MD5, we can easily generate collisions (that is, pairs of images that hash to the same value), however that's not useful in attacking HMAC-MD5 (assuming the attacker doesn't know the key; if he does, he can use that knowledge to create two values that HMAC-MD5 to the same tag).  In fact, there's no known attack against HMAC-MD5 that's more effective than "brute force search of the key".

Please don't use this advice as an excuse to use HMAC-MD5, however.

On the other hand, a sufficiently weak hash (e.g. MD4) does give you a weak HMAC; and so the answer to your question is "yes, a weak hash can give you a weak HMAC"; the hash just has to be weaker than what we know MD5 to be...