As stated in the HMAC RFC (RFC 2104):

The strongest attack known against HMAC is based on the frequency of collisions for the hash function H.

How can a collision benefit an attacker? I would have thought that the strongest attack would be a brute force attack aimed at discovering the secret key.


1 Answer 1


From that same document:

In any case the minimal recommended length for K is L bytes (as the hash output length).

So as long as the key is fully randomized, i.e. a cryptographically strong key, the time for brute forcing is at least the same or higher than the time finding a collision. If your key is indeed smaller or not fully randomized, then brute forcing attacks may indeed apply.

If you can find a collision, then you could possibly replace the message. But the hash would still be dependent on the key, so you should see this as a strict lower bound. An attacker would still not break HMAC by only finding a collision (otherwise HMAC with MD5 would be broken by now).

For instance, Wikipedia mentions:

The cryptographic strength of the HMAC depends upon the size of the secret key that is used. The most common attack against HMACs is brute force to uncover the secret key. HMACs are substantially less affected by collisions than their underlying hashing algorithms alone.Therefore, HMAC-MD5 does not suffer from the same weaknesses that have been found in MD5.

  • $\begingroup$ Note that means that even with MD5, you are likely to achieve 128 bit security if you use all the bits. As MD5 is very broken, I would still recommend one of the SHA-2 hash algorithms instead, of course. If the key is random enough, HMAC itself is not likely to be the component of the highest risk within your secure system. $\endgroup$
    – Maarten Bodewes
    Aug 15, 2014 at 15:54
  • $\begingroup$ If you find a collision, you can replace the message but only with the message matching the collision right? So unless you're able to find a large number of collision this would not be that useful right? $\endgroup$
    – Bruno Bieth
    Aug 18, 2014 at 8:01
  • 1
    $\begingroup$ For MAC, not even that, as you need to find a message that creates a collision when combined with the key. So a collision is not very likely or useful. But because the key should be at least as large as the output size, any effective attacks (i.e. better than brute force) on the HMAC should have less complexity by definition than an attack on the key. $\endgroup$
    – Maarten Bodewes
    Aug 18, 2014 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.