Assume you had no option (really) but to store thousands of credit card PANs in a file. You do not need to decrypt them ever, but you do need to use it for checking if a given (new) PAN exists in that list.

To protect the PANs, the idea is to HMAC-SHA256 them. This scheme naturally relies on the HMAC secret remaining secret. Please assume for this question we can take that as given (HSM). Also, that the secret is a truly random 64 byte secret.

Is there any kind of attack that could be realistically mounted to crack this? One can reduce the search space by knowing that credit Card PANs have an obvious pattern - from 15/16 digits, one can remove the luhn digit, and the first (say) 6 digits (BIN).

An attacker would pick a likely BIN, and then iterate through the 10^9 possible PANs, hashing them against every possible key.

This looks to me like it would take longer than the universe's expected life, even with incredible hardware. Exhaustive hashes required = 10^9 * 2^512.

Having prior knowledge that a given PAN is definitely on the list,and thus dividing the number of hashes by 10^9, does not make any real difference.

Have I missed anything here, or is this reasoning correct?

  • 4
    $\begingroup$ As long as your HSM is secure, an online attack that sends each guess to the HSM seems like the most practical attack, and that's still a rather limited attack because the HSM can apply rate limiting and might warn about the suspicious behaviour. $\endgroup$ Commented Oct 27, 2016 at 17:04
  • $\begingroup$ I'm not sure if you can expect 512 bits of security out of HMAC-SHA-256, but it's not like there is a security level above "utterly infeasible to break", so it doesn't matter in practice if it's "only" 256 or 512. (I can think of a 2^128 online attack followed by a 2^256 offline attack, but the online part of it is far more expensive than simply running every possible credit card number through the HSM, so it isn't really applicable) $\endgroup$ Commented Oct 27, 2016 at 17:05

3 Answers 3


If you consider the hardware security module with the HMAC as a PRF (also see this question at security-SE), then you can build upon that security assumption and use it like a random oracle . However, there is the additional risk of the HSM being broken and the key extracted.

Under that assumption, there is no efficient way to extract the key. And you noticed yourself, that a brute force over keys and possible inputs is infeasable - regardless if the PAN is known or included in the search.

From a cryptographic point of view, this is a solid start. But for a practical application, security weaknesses are basically never in the cryptographic primitives - if used correctly and not outdated. It is much more likely, that the attacker gets access to the HSM and use it (without raising suspicion). With that, the attacker could brute force the PANs, but he could also use it on a number of his choice and try to add that to the list. It might also be possible to evesdrop before the PAN is processed by the HSM when checking if it is in the list.

  • $\begingroup$ Thanks for the ref to random oracle. How feasible is it to break the HSM in practice? $\endgroup$
    – Nik
    Commented Oct 27, 2016 at 19:29
  • $\begingroup$ @Nik Your HSM should come with a security certification that rates how hard it is to break. Beware of the small print in the certificate (the security target or security policy, and the user/operator guidance) which states under what assumptions the certificate is valid — the assumptions may or may not be realistic. $\endgroup$ Commented Oct 27, 2016 at 21:40

Under your assumptions, everything will be secure, as long as HKDF is secure and your key is secure (assuming attacker has only offline access to data, not be able to for example check if given credit card number was already entered). Currently even 2^128 is far out of our reach. But I wouldn't say that this will remain until end of universe. It is possible that in future we will find SHA-2 weaknesses and be able to use them to crack your solution.

Your scheme can however be easily broken if key was stolen. If this is consideration, you can reduce output size and increase risk of collision while making attacker struggle with same thing. However, I have no idea if this allowable in your scheme since you didn't give any details on how such thing would be used.

All in all, I would be most scared of flaw that would give attacker ability to do, what you can do: Check if number is on list, because of breach and access to HSM interface (which can also suppress any warnings of hash rate etc.).


There is no possible attack on this. As u are using HMAC-SHA256, There is no possible brute force or dictionary attack on this. If you are concerned with PCI-DSS and PA-DSS compliance, you are allowed to decrypt and match. Also you are using HSM means that nobody can get your key unless your hsm is tampered. So there is no possibility.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.