Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When doing encrypt-then-mac, I can choose to use a as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC.

Does it increase security when choosing a hash with a larger bit-size? Is a HMAC based on SHA-256 weaker than a SHA-512, or doesn’t it really matter because both are cryptographically secure?

share|improve this question
up vote 3 down vote accepted

HMAC-SHA-256 is sufficient for up to 256 bit security. Confer e.g. NIST SP 800-107. This recommendation is based on the premise that collision attacks are infeasible against common uses of HMAC, and that you consequently only have to worry about primary pre-image attacks that attempt to recover the secret key (and use this for forging subsequent messages).

SHA-256 has 256 bit security against primary pre-image attacks. This is sufficient for all practical purposes.

share|improve this answer
This is also why HMAC-SHA1 is still commonly used, even though the SHA-1 algorithm shouldn't be used anymore for e.g. signature generation. It is unlikely that SHA-1 will be vulnerable to first pre-image attacks, and the 160 bit output size offers enough security. Of course, if possible, you should still move to SHA-2 or SHA-3 (when the latter has been standardized). – Maarten Bodewes Jul 20 '14 at 12:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.