# HMAC-SHA-512 with a 256-bit key

I am implementing hmac-sha-512 in an integrated system. However, one subsystem is only supports the use of 256-bit keys.

However, note that [HMAC] strongly discourages a key length less than the output length. Nonetheless, we describe handling of shorter lengths here in recognition of shorter lengths typically chosen for IKE or IKEv2 pre-shared keys.

And also:

These key length restrictions are based in part on the recommendations in [HMAC] (key lengths less than the output length decrease security strength, and keys longer than the output length do not significantly increase security strength), and in part because allowing variable length keys for IPsec authenticator functions would create interoperability issues.

In what way does using a 256-bit key rather than a 512-bit key with HMAC-SHA-512 decrease its security strength? Is it not advisable to proceed with a 256-bit key?

• Think of it this way: using a 256-bit key when it expects a 512-bit key is like letting the world know half of your key. Using a half-strength key may still be plenty strong in practice, but it clearly shouldn't be the recommended norm.
– Mr. Llama
Sep 20 '18 at 23:58
• I think the general answer is that HMAC-512 with a 256-bit key means you're lowering your security to the level of the 256-bit key, so you're spending CPU cycles on this 512 hash and not getting the full benefit out of it. However there are some subtleties here, so I've flagged this question to be migrated to crypto.SE Sep 21 '18 at 0:02
• I am pretty sure that basically you'd get 256 bit security for a 256 bit key. The HMAC construction is pretty sturdy and resists quite a bit of abuse. If your runtimes support it you can simply choose the lesser known SHA-512/256 hash and sidestep the issue (this - security wise - is the same as using SHA-512 with a 256 bit key which kind of proves the above without really doing so). Obviously there is no need for a 512 bit security strength; 256 bit is more than enough. Sep 21 '18 at 10:40
• Do you care about attackers willing to dedicate a dyson sphere to cracking your crypto? Sep 21 '18 at 11:01
• Using "only" 256 bits with HMAC/SHA-512 means that it could be broken by a 2nd-tier deity like Hermes or Dionysus, without having to refer to Zeus himself. Against puny mortal humans, though, it should be fine. Sep 21 '18 at 13:13

It doesn't, in any real sense. With a 256 bit key, it can be broken by searching through a key space of size $$2^{256}$$; a simple computation on the energy required to do such a search shows that it is ludicrous (and is the source of the 'Dyson Sphere' comment made by CodesInChaos).
If we assume that the attacker had a working reliable Quantum Computer, he could, in theory, attack the system by performing $$O(2^{128})$$ HMAC-SHA512 evaluations, which is still not very practical, but not nearly as ludicrous. However, to achieve such a 'low' number of computations, he would have to perform those computations serially (which would extend the total time taken to do the search to something longer than the current age of the universe). Yes, he could speed things up by using multiple parallel Quantum Computers, but it turns out that drastically increases the already huge number of evaluations required.