# Key size for HMAC-SHA256 [duplicate]

After reading a bunch of past stack exchange posts like this one and RFCs 5869, 2104, and 4868 I felt comfortable that a 32-byte key was sufficient for HMAC-SHA256. However, I am implementing my code in C# and someone pointed out to me that the Microsoft HMAC-SHA256 documentation recommends a 64-byte key:

The key can be any length. However, the recommended size is 64 bytes.

Is there any good reason to use a 64-byte key instead of a 32-byte key?

• 64 byte is the block size of SHA-256. – Artjom B. Apr 26 '16 at 14:36
• You could always expand a 256-bit key with a 512-bit hash such as SHA512, if you do not have a shortage of cpu power – Richie Frame Apr 27 '16 at 0:22

On the other hand, 256 bits of security is way more than enough for anything even vaguely foreseable, including quantum computers. If MACs are computed at a rate of $2^{88}$ per year (requiring hashing effort slightly superior to what's devoted to bitcoin mining), and they could be checked among known MACs for $2^{32}$ different keys at that rate (arguably requiring more additional effort than hashing), and we wanted residual odds of $2^{-35}$ that any key is found within 32 years, 160 bits of key entropy is enough, ignoring quantum computers.
If the key is not known to be full-entropy, there is an obvious, reasonable argument that large keys are necessary. For example, if the key was a diceware passphrase, which has an entropy of $5\log_2(6)\approx12.9$ bit/word, there needs to be 20 words in the key, that is up to 139 characters (with 6 characters per word, and space between words), to reach 256 bits of entropy.