Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$? (Assume that $k$ was chosen at random.)

  • 4
    $\begingroup$ No, since HMAC is believed to be secure. $\;$ $\endgroup$
    – user991
    Commented May 30, 2013 at 20:27
  • $\begingroup$ Anyone cares to comment on the downvotes? $\endgroup$
    – Eugen
    Commented May 31, 2013 at 11:38
  • 1
    $\begingroup$ @Eugen, people expect you to do some independent research of your own to try to answer your own question, and show your work (show what you've tried so far). In this case, reading an elementary textbook that describes chosen-plaintext attacks and describes the theory of message authentication codes should be enough for you to work out the answer on your own. $\endgroup$
    – D.W.
    Commented Jun 2, 2013 at 4:20
  • $\begingroup$ Well, I did read some elementary work on MAC and HMAC. However I couldn't find somewhere an analysis of the question I am asking. Note I am not asking the recoverability of the input message. Nor I am asking about the probability of tag collisions (which in case of HMAC is given by the generic birthday attack). I wonder why some users make so many assumptions about the people that ask questions.. In any case @D.W. thank you for at least commenting on the question. $\endgroup$
    – Eugen
    Commented Jun 2, 2013 at 9:00
  • 1
    $\begingroup$ Another reason for my downvote is that the title does not match the body of the question. I fully agree to this answer, and that it answers the question as worded in its body. But I would not be so sure the question in the title can be answered with no, or at all. Revealing one $m$ and even the low-order bit of $HMAC(k,m)$ "leak information" on $k$ in some sense, for about half the $k$ can be eliminated. $\endgroup$
    – fgrieu
    Commented Jun 3, 2013 at 7:03

1 Answer 1


No. Assuming HMAC is secure against known-plaintext attacks (which is a plausible assumption), the key cannot be recovered. This follows directly from the definition of a known-plaintext attack; if you could recover the key, you would have a successful known-plaintext attack on HMAC.

  • 3
    $\begingroup$ This is only true if the effective key space is actually large enough to avoid brute-forcing, though. $\endgroup$ Commented Jun 3, 2013 at 18:43
  • $\begingroup$ @PaŭloEbermann, I don't think that's right. If the key space is too small, then it's not secure against known-plaintext attacks. If you know that it is secure against known-plaintext attacks, then you know that the key space has to be large enough to avoid brute-forcing. $\endgroup$
    – D.W.
    Commented Jun 3, 2013 at 18:59
  • $\begingroup$ Yes, my comment was meant as "your assumption is only true if ...". Sorry for the confusion. $\endgroup$ Commented Jun 3, 2013 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.