in a project that I am working on we have been tasked with eliminating PGP while providing sufficient security to protect payment files only within the Company's trusted network. We arrived at HMAC SHA256. Assuming that we can keep the key private and refresh the (128 bit) key annually, can someone comment on how difficult it would be to compute the key if an attacker got the plaintext and the hash? The files on average are about 2mb in size.
With regards to the algorithm, HMAC-SHA256 is considered very secure. As with most symmetric algorithms it can probably not be proven secure, but that should not worry you overmuch.
The most important security consideration with HMAC is to use a time consistent compare when verifying the authentication tag. A 256 bit key could be considered for the simple reason that the overhead won't make any difference when ~2MB files are being protected.
It's probably better to focus on other parts of the system security and make sure you implement the key management well.