Let's assume that we have a hash value $h$ is calculated by using HMAC-SHA256.

We have the key $k$. We also know some information about the input:

  • It contains a pattern like 15 numbers where first 7 are known;

Question: Is it possible to find at least one input $m$ such that $h = \operatorname{HMAC-SHA256}(k,m)$ without generating all possible patterns?

  • 2
    $\begingroup$ is it HMAC-SHA256? are we going to guess the hash value or input? since you say you know a hash $\endgroup$
    – kelalaka
    Commented Nov 28, 2018 at 7:22
  • $\begingroup$ Is there actually a hash that just called "256" or just a typo? You've no luck if it's actually pre-image resistant. $\endgroup$
    – DannyNiu
    Commented Nov 28, 2018 at 8:11
  • $\begingroup$ @kelalaka we are going to guess the input. I'm the one who posted at first :) $\endgroup$
    – jykill
    Commented Nov 28, 2018 at 9:46
  • $\begingroup$ It appears that you have accidently created two accounts, please now follow the instruction in our help center for this situation to resolve this issue. $\endgroup$
    – SEJPM
    Commented Nov 28, 2018 at 19:11

1 Answer 1


First of all, HMAC is not exactly a hash function. The Wikipedia clearly states that;

In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key.

In case of HMAC-SHA256, the hash function in the HMAC is SHA256.

Remember that, Cryptographic hash functions are not invertible functions, and we require that they have pre-image, second pre-image, and collision resistance.

There is still an ambiguity in the question; I'll try to answer in two ways.

  1. The input is exactly 15 numbers where first 7 are known.

    In this case, the input space is limited, 8 unknown numbers this makes $10^8 \approx 2^{27} $ and this input space can be tested very quickly even with a raspberry pi.

    What about finding a $m$ without generating the pattern. Actually, this means that, you are looking for pre-image for HMAC-SHA256. There is no known attack for HMAC. For alone SHA-256 there are pre-image attacks, for example:

    This will be infeasible. Note that practical collision attacks for SHA-256/512 is possible with reduced rounds 26/64 and 27/80, respectively.

  2. The input contains 15 numbers where first 7 are known.

    In this case, we have a structure as;


    Knowing some part of the input may help with testing each value. Unfortunately, there is no information about the prefix (p) size and suffix (s) size. So, one has to consider cases.

    What about finding a $m$ without generating the pattern. The pre-image status is the same as in the first case.

  • 1
    $\begingroup$ HMAC with a fixed, known key (i.e. $m \mapsto HMAC_k(m)$) is a cryptographic hash function if the underlying hash is. (A MAC with a fixed key is not a hash function in general: if you know the key it may be possible to construct collisions or calculate inverses.) $\endgroup$ Commented Dec 29, 2018 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.