0
$\begingroup$

Is it safe to truncate HMAC? What is the minimum length of a truncated HMAC so that HMAC is still considered to be safe to use? Are there any standards on when it comes to shortening HMAC?

In my case, the hash function is SHA-256. Would the answer also be applicable for any other hash function?

Improve this question
$\endgroup$
4
  • 3
    $\begingroup$ What do you mean by 'strip'/'stripped'? Truncated? You should use the full output length (256 bits) if you want something committing (128 bits of collision resistance), and you probably do want that. If commitment isn't required for some reason, you can truncate HMAC down to 128 bits. With HMAC-SHA-512, you'd usually truncate it to 256 bits, which would also be committing. $\endgroup$
    – samuel-lucas6
    Commented Aug 19, 2022 at 22:13
  • 1
    $\begingroup$ @samuel-lucas6, Yes, I mean truncated. Thank you for your answer. Would it be safe to truncate HMAC down to 64 bits or less? What is the minimum length of truncated HMAC is still considered to be secure? $\endgroup$
    – g00dds
    Commented Aug 19, 2022 at 22:37
  • 3
    $\begingroup$ It depends on how HMAC is used if you ask me. If you can try indefinitely for the same key then having 64 bits of authentication tag would be problematic. However, if you e.g. break down the communication channel entirely (e.g. when used in a TLS like protocol) that is used for real time communications then HMAC-256 cut down to 64 bit may still offer some security. $\endgroup$
    – Maarten Bodewes ♦
    Commented Aug 19, 2022 at 23:16
  • 2
    $\begingroup$ I completely agree with @MaartenBodewes. However, I wouldn't personally go below 128 bits, and you don't need more than 256 bits. $\endgroup$
    – samuel-lucas6
    Commented Aug 20, 2022 at 7:46

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.