Not sure about the security implications of making HMAC SHA1 message and corresponding hash public (secret would remain… secret)?

Evaluating if that would help an attacker crack algorithm.

  • $\begingroup$ What's trying to be kept secret? Without the key, an attacker will not be able to produce the tag/hash. When you do Encrypt-then-MAC, the message (the ciphertext) and tag are public. $\endgroup$ Commented Sep 1, 2022 at 17:26

1 Answer 1


No, HMAC is using a one way hash in a construction that avoids length extension attacks. But even without that: the key is only used as input to a one way hash algorithm. So getting the value of the key should be impossible if you have any set of input message and HMAC output.

To "crack the algorithm" you'd need to analyze the algorithm. But if you do that an attacker can just use their own set of inputs / outputs, including any key. Having the output just helps with verifying that the key would be correct. HMAC should be secure regardless.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.