Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key.

Would this person be able to derive any information about my secret key? Furthermore, would this person have a way of being able to forge a valid HMAC for a similar message (e.g. the letter "B")?


No, they would not be.

At least, to this date[Feb. 2020], there are no known vulnerabilities relating to short messages with sufficiently sized keys. If this is all you cared about, feel free to stop reading here. The rest of the answer just go into details as to why it's not a problem.

According to RFC 2104, a HMAC is defined as follows:

HMAC(K,m) = H((K' xor opad) || H((K' xor ipad) || m)); K' = H(K) if K > block size, K otherwise

As you can see, the key is XOR'd with a known constant, then concatenated with the message. This data is hashed, then concatenated to other data and finally hashed again. If the message m were just all zero's, it would still not give you any information about the key.

This can be demonstrated by a simpler construct, where all that happens is that the key itself is being hashed. One would not have any information about the key, and the best way of recovering it is brute force.

| improve this answer | |
  • Thank you, would a sufficiently sized key be 64 bits? 128? – BobbyTables Feb 13 at 10:48
  • 1
    64 bytes, so 512 bits is recommended [1] [2]. This fills out the block completely. Anything larger would need to be hashed. 64 bit keys are generally considered too small for anything. – MechMK1 Feb 13 at 11:01
  • Yikes, dodged that one. Had 64 (something) in the back of my head. Edit: upon further review, i had a 64 byte key, and not bits – BobbyTables Feb 13 at 11:42
  • 1
    @BobbyTables In cryptography, 128 bits of security is generally considered the lower bound of anything secure. Note that 128 bits of security are not necessarily 128 bits of key length. For some symmetric ciphers, such as AES, you do indeed get one bit of security per bit of key length. Others, such as RSA, fare way worse. – MechMK1 Feb 13 at 12:10
  • You should clarify that you're answering "no" to the question in the body, not the one in the title. – Joseph Sible-Reinstate Monica Feb 13 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.