# Is HMAC prone to birthday attacks?

Popular attacks on cryptographic hash algorithms are "birthday attacks" . At high level ,

if a hash function produces $n$ bits of output, an attacker who computes only $2^{n/2}$ hash operations on random input is likely to find two matching outputs

Is the same true for HMAC ? Or are HMAC with any underlying Hashing (like MD5/SHA-2) prone to birthday attacks ? If not why not ?

Note : this question is not a duplicate of What are the implications of a birthday attack on a HMAC?

• How are you using HMAC? Just as a PRF/MAC? – CodesInChaos Aug 10 '16 at 16:39
• Just as MAC not as PRF – sashank Aug 10 '16 at 17:35
• @CodesInChaos am curious will the answer change if HMAC was used as a PRF ? – sashank Aug 11 '16 at 4:34
• No, but it'd change if you used it without a key. – CodesInChaos Aug 11 '16 at 5:49

Yes, HMAC outputs are hashes of something so after $2^{n/2}$ you expect two to match.