Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key

I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length is 128 bits, it does not change. The "word" is literally one short word.

Assuming an attacker knows "word" and "output" for multiple words (e.g., dog = "dsfwrw3r3r323211", cat = "3erwerwetwewer"):

  • Is it significantly easier for an attacker to identify the private key by brute force with the above word/output pairs, as compared to a situation where they do not have those pairs?
  • Is this brute force vulnerability (with word/output pair knowledge) an actual security concern?
share|improve this question
Short answer: it is fine until the private key is compromised. Hopefully someone can provide the long answer. – Thomas Apr 23 '13 at 16:34
up vote 7 down vote accepted

I'll assume that "sha256hmac" designates HMAC using SHA-256 as the underlying hash function.

HMAC is used for its intended usage: the first parameter privatekey is a key, I assume random and secret, of fair length (128-bit); the second parameter word is a (possibly public) message; output is a (possibly public) cryptogram. Observing any number of (word, output) pairs, even for word of an adversary's choice, will not enable to recover privatekey or otherwise compute new result.

Its hard to tell if having (word, output) pairs makes the task significantly easier: it goes from impossible with no pair at all, to infeasible using any foreseeable technology with some pairs (unless we consider quantum computers practically applicable to cryptography as foreseeable, which requires some dose of optimism).

With one privatekey of 128-bit, I think we are good against brute force for two decades, with fair confidence. If there was billions privatekey and the adversary could obtain output for the same word for each of these privatekey, we would NOT be quite that safe with the 128-bit key size (the adversary has a remotely feasible task of finding one privatekey), and we would need more bits: 192 are fine, 256 aplenty.

The most practical danger is privatekey leaking, by organizational means, or side-channel attack.

share|improve this answer
Thank you, I appreciate the answer! – user1373208 Apr 24 '13 at 2:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.