Can an attacker guess the key given enough codes for the same key? And if so, how many times is it safe to use the same key?


I don't think there is any official limitations when it comes from standardization bodies such as NIST. However, there do seem to be some papers such as New Generic Attacks Against Hash-based MACs.

They show that HMAC may have less security than previously thought after the birthday bound. Generally, if you have a hash output size of, say 256 bits for SHA-256 then you may have to start worrying after $2^{128}$ messages. This is of course not a limit that should worry you.

Even for SHA-1 you're probably going to be fine. However, you may want to stop using (MD5 for which the bound is a worrying $2^{64}$) and SHA-1 by now for other reasons than just the output size; there are too many attacks on those hash functions and attacks only get better.

Just use a modern hash function - SHA-2 or SHA-3 - as base for HMAC and you'll be alright. For SHA-3 you might want to take a look at KMAC as well, although support for that particular MAC is sparse.

  • 4
    $\begingroup$ TL;DR: a single CPU is not powerful enough to make enough HMAC that it becomes unsafe, for any common hash, even the broken MD5 or SHA-1 as far as we know. But use at least SHA-256. $\endgroup$
    – fgrieu
    Mar 2 '20 at 4:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.