No, you are not leaking any information except how to MAC those specific values with the specific key you are using. Using a short message is exactly as secure as using a long message.
For the following, remember the definition HMAC (K,m) = H((K ⊕ opad) || H((K ⊕ ipad) || m))
. There are two hashes here, an outer hash and an inner hash nested inside the outer one. The message is inside the inner hash.
Suppose I am an attacker who has your message and MAC result, and I want to derive your key. In order to get your key, I will need to do a brute-force guess. I already know the function H
, I know the constants ipad
and opad
, and I know your message m
. I need to try building lots of hashes using different key values until I come up with the right HMAC. The hardness of this task is dependent entirely on the length of K
; the length of m
is not a factor.
Note, however, that if you are not using a temporary key, then any message/HMAC pairs you give out you will be valid for your key, so an attackedattacker could impersonate you in a replay attack for any messages she has seen from you.