HMAC Secure Key Exchange? Within RFC 2104 section 3 there is discussion around keys (below). How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute keys?


  "Keys need to be chosen at random (or using a cryptographically strong
  pseudo-random generator seeded with a random seed), and periodically
  refreshed.  (Current attacks do not indicate a specific recommended
  frequency for key changes as these attacks are practically infeasible.
  However, periodic key refreshment is a fundamental security practice
  that helps against potential weaknesses of the function and keys, and
  limits the damage of an exposed key.)"
How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute keys?


The answers to those questions are beyond the scope of the RFC. So, it depends on the context in which HMAC is being used. The keys can be agreed upon/distributed in any secure manner. The RFC doesn't care. It could be via asymmetric crypto, it could be in person, it could be via carrier pigeon (if that is considered secure in your threat model).