1

Theoretically, python function for encrypting a HMAC SHA256 looks like this:

hmac_sha256(key, text)

The word "hello" was encrypted using the function like so:

hmac_sha256("hello", "hello")

How easy would it be for someone to decrypt this, knowing that the original message equals the key?

4

How easy would it be for someone to decrypt this, knowing that the original message equals the key?

If all you know is that they key equals the message, then attacking the HMAC practically impossible. If you look at how HMAC gets computed you can see that you would somehow need to get the input to a SHA-256 hash from a known output. This would mean you need to mount a successful pre-image attack against SHA-256 which is considered practically impossible today.

2

Assuming both the key and the message have a reasonable amount of entropy, then as Steffen Ullrich said, it reduces to the same level of security as SHA-256 of the input. (The values will not be the same, of course, but it will be the same level of complexity to invert.)

However, if your string is as simple as "hello", then a dictionary attack is quite reasonable. Any operation that uses only low-entropy inputs is susceptible to such an attack: just insert all possible input values and find the one whose output matches.

Using HMAC SHA-256 in the way you've described does not seem to offer any benefits beyond a plain SHA-256. Also please note than hashes and MACs are not "encryption" -- they are supposed to be one-way operations whether or not you have the HMAC key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.