Assume you had no option (really) but to store thousands of credit card PANs in a file. You do not need to decrypt them ever, but you do need to use it for checking if a given (new) PAN exists in that list.
To protect the PANs, the idea is to HMAC-SHA256 them. This scheme naturally relies on the HMAC secret remaining secret. Please assume for this question we can take that as given (HSM). Also, that the secret is a truly random 64 byte secret.
Is there any kind of attack that could be realistically mounted to crack this? One can reduce the search space by knowing that credit Card PANs have an obvious pattern - from 15/16 digits, one can remove the luhn digit, and the first (say) 6 digits (BIN).
An attacker would pick a likely BIN, and then iterate through the 10^9 possible PANs, hashing them against every possible key.
This looks to me like it would take longer than the universe's expected life, even with incredible hardware. Exhaustive hashes required = 10^9 * 2^512.
Having prior knowledge that a given PAN is definitely on the list,and thus dividing the number of hashes by 10^9, does not make any real difference.
Have I missed anything here, or is this reasoning correct?