Let's assume that we have a hash value $h$ is calculated by using HMAC-SHA256.

We have the key $k$. We also know some information about the input:

  • It contains a pattern like 15 numbers where first 7 are known;

Question: Is it possible to find at least one input $m$ such that $h = \operatorname{HMAC-SHA256}(h,m)$ without generating all possible patterns?

  • 2
    is it HMAC-SHA256? are we going to guess the hash value or input? since you say you know a hash – kelalaka Nov 28 at 7:22
  • Is there actually a hash that just called "256" or just a typo? You've no luck if it's actually pre-image resistant. – DannyNiu Nov 28 at 8:11
  • @kelalaka we are going to guess the input. I'm the one who posted at first :) – jykill Nov 28 at 9:46
  • It appears that you have accidently created two accounts, please now follow the instruction in our help center for this situation to resolve this issue. – SEJPM Nov 28 at 19:11

First of all, HMAC is not exactly a hash function. The Wikipedia clearly states that;

In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key.

In case of HMAC-SHA256, the hash function in the HMAC is SHA256.


Remember that, Cryptographic hash functions are not invertible functions, and we require that they have pre-image, second pre-image, and collision resistance.


There is still an ambiguity in the question; I'll try to answer in two ways.

  1. The input is exactly 15 numbers where first 7 are known.

    In this case, the input space is limited, 8 unknown numbers this makes $10^8 \approx 2^{27} $ and this input space can be tested very quickly even with a raspberry pi.

    What about finding a $m$ without generating the pattern. Actually, this means that, you are looking for pre-image for HMAC-SHA256. There is no known attack for HMAC. For alone SHA-256 there are pre-image attacks, for example:

    This will be infeasible. Note that practical collision attacks for SHA-256/512 is possible with reduced rounds 26/64 and 27/80, respectively.

  2. The input contains 15 numbers where first 7 are known.

    In this case, we have a structure as;

        ppp...pppfffffffrrrrrrrrsss...sss
    

    Knowing some part of the input may help with testing each value. Unfortunately, there is no information about the prefix (p) size and suffix (s) size. So, one has to consider cases.

    What about finding a $m$ without generating the pattern. The pre-image status is the same as in the first case.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.