2

Imagine I were to provide a person with a single letter "A" and the HMAC-SHA256 hash of this message, keyed with my secret key.

Would this person be able to derive any information about my secret key? Furthermore, would this person have a way of being able to forge a valid HMAC for a similar message (e.g. the letter "B")?

Improve this question

1 Answer 1

Reset to default
3

No, they would not be.

At least, to this date[Feb. 2020], there are no known vulnerabilities relating to short messages with sufficiently sized keys. If this is all you cared about, feel free to stop reading here. The rest of the answer just go into details as to why it's not a problem.

According to RFC 2104, a HMAC is defined as follows:

HMAC(K,m) = H((K' xor opad) || H((K' xor ipad) || m)); K' = H(K) if K > block size, K otherwise

As you can see, the key is XOR'd with a known constant, then concatenated with the message. This data is hashed, then concatenated to other data and finally hashed again. If the message m were just all zero's, it would still not give you any information about the key.

This can be demonstrated by a simpler construct, where all that happens is that the key itself is being hashed. One would not have any information about the key, and the best way of recovering it is brute force.

Improve this answer
6
  • Thank you, would a sufficiently sized key be 64 bits? 128?
    – BobbyTables
    Commented Feb 13, 2020 at 10:48
  • 1
    64 bytes, so 512 bits is recommended [1] [2]. This fills out the block completely. Anything larger would need to be hashed. 64 bit keys are generally considered too small for anything.
    – user163495
    Commented Feb 13, 2020 at 11:01
  • Yikes, dodged that one. Had 64 (something) in the back of my head. Edit: upon further review, i had a 64 byte key, and not bits
    – BobbyTables
    Commented Feb 13, 2020 at 11:42
  • 1
    @BobbyTables In cryptography, 128 bits of security is generally considered the lower bound of anything secure. Note that 128 bits of security are not necessarily 128 bits of key length. For some symmetric ciphers, such as AES, you do indeed get one bit of security per bit of key length. Others, such as RSA, fare way worse.
    – user163495
    Commented Feb 13, 2020 at 12:10
  • You should clarify that you're answering "no" to the question in the body, not the one in the title.
    – Joseph Sible-Reinstate Monica
    Commented Feb 13, 2020 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .