# Correlate HMAC key and MAC without message

If I have a HMAC_SHA1 MAC and a potential key, can I check whether this key could have produced this signature without knowing any of the message body plaintext?

If I have a HMAC_SHA1 signature and a potential key, can I check whether this key could have produced this signature without knowing any of the message body plaintext?

No, there is no known efficient way.

Now, if you look at how HMAC works internally, then there will be (with high likelihood) will be values that cannot be produced by a specific key; that is, values which cannot be achieved by any message $$M$$. This happens because the inner SHA-1 hash summarizes the message $$M$$ into a 160 bit value (in a key dependent operation); then it performs another key dependent operation t(the outer hash) to convert it into another 160 bit value. This transform is unlikely to be invertible, and hence there are likely 160 bit outputs that cannot happen.

However, even though those impossible values almost certainly exist, we have no way of finding what these values might be, or whether if any specific output is one of those.

Also, a minor terminology note:

If I have a HMAC_SHA1 signature

In crypto, we tend to use the term 'signature' to refer to a public key signature operation (which HMAC is not). Instead, we might call it an HMAC_SHA1 MAC (Message Authentication Code)

• I stand corrected :v – Mihail Malostanidis Oct 4 '18 at 20:21
• ... MAC or authentication tag, although the latter specifies a use case as well, and is more commonly used for authenticated ciphers. – Maarten Bodewes Oct 5 '18 at 1:43