When doing encrypt-then-mac, I can choose to use a as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC.

Does it increase security when choosing a hash with a larger bit-size? Is a HMAC based on SHA-256 weaker than a SHA-512, or doesn’t it really matter because both are cryptographically secure?


HMAC-SHA-256 is sufficient for up to 256 bit security. Confer e.g. NIST SP 800-107. This recommendation is based on the premise that collision attacks are infeasible against common uses of HMAC, and that you consequently only have to worry about primary pre-image attacks that attempt to recover the secret key (and use this for forging subsequent messages).

SHA-256 has 256 bit security against primary pre-image attacks. This is sufficient for all practical purposes.

  • 1
    $\begingroup$ This is also why HMAC-SHA1 is still commonly used, even though the SHA-1 algorithm shouldn't be used anymore for e.g. signature generation. It is unlikely that SHA-1 will be vulnerable to first pre-image attacks, and the 160 bit output size offers enough security. Of course, if possible, you should still move to SHA-2 or SHA-3 (when the latter has been standardized). $\endgroup$ – Maarten Bodewes Jul 20 '14 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.