First let me admit that I am not a mathematician or a cryptographer. I am responsible for assisting in making a recommendation on a project that is consolidating payment processes within a company's internal network.
We have payment files which are being created by various applications; Several legacy applications are using PGP to digitally sign the payment files (sign only - no encryption. The hash algorithm is SHA1 and the digital signature algo is RSA 1024). Several newer applications are protecting the payment files using SHA256 HMAC (using a 256 bit random private key).
Regardless of whether we decide on public key cryptography (PGP) or secret key cryptography (HMAC), we will replace the keys periodically and feel reasonably assured that we can protect the private key and passphrase or the secret key for HMAC.
The question has been raised questioning the relative strength of SHA256 HMAC vs. PGP digital signature. We know that the PGP digital signature is appended to each payment file, and network admins and others can easily copy signed payment files (but they cannot get to the PGP keys folder nor the passphrase). Similarly, the SHA256 HMAC hashtag value and the original plaintext payment file can be accessed by admins, but not the secret key.
Given that in both sets of applications a potential adversary can get the original plaintext and the digital signature or HMAC Hashtag, which of these two scenarios would be least vulnerable to brute force or other attacks that attempt to derive the private or secret key? Based on current computing power, how long should we have reasonable assurance that either technology would be relatively secure?