Given current technology such as GPUs and GPU cracking software I was wondering if anyone has an idea on how long it would take to brute force the key used to derive an HMAC?

  • 5
    $\begingroup$ If it's a proper key (128 random bits) then it's completely infeasible. If the key is derived from a password, it depends on the password and the derivation function. But in that case you don't attack HMAC, you attack the password. $\endgroup$ Mar 19, 2013 at 21:38

1 Answer 1


CodeInChaos has it right about the infeasbility of this against a random key; however, lets run the numbers to see how extremely correct he is:

Let us assume we are attacking HMAC-MD5 within TLS; this has a 128 bit key.

The fastest GPU server (actually, it has 25 GPUs internally) can test about 400 billion keys per second.

Let us assume that we, having a huge budget, have assembled 1 million of the above units; that means that we can test $4 \times 10^{17}$ keys per second; sounds impressive.

However, it'll take an average of $2^{127}$ keys tested before we recover the HMAC-MD5 key; at $4 \times 10^{17}$ keys per second, that'd be $4 \times 10^{20}$ seconds, or about $10,000,000,000$ years. I'd call that somewhat impractical; if nothing else, the sun will become a red giant and destroy our set up before we're likely to find a result.

It gets even worse if we talk about HMAC-SHA1; that uses 160 bit keys; that increases the amount of time we'd expect to take by about 4 billion.

Yes, if what we're talking about is a key derived from a password, GPUs can be used. However, when we're talking about random keys, they don't come close to scratching the algorithm.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.