I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data.

  1. Generate a non-secret 64 byte random string $M$ (fixed challenge)
  2. Generate a secret 20 byte random string $K$ (HMAC key)
  3. Compute $E = \operatorname{HMAC-SHA1}(K, M)$

$E$ is a 20-byte encryption key that is used to encrypt some data (with some well-known cryptographically secure algorithm). $M$ is kept alongside the data, while $K$ is separated from it and kept secret. Whenever data has to be accessed, $K$ is retrieved and the HMAC computation is repeated to re-generate $E$ and decrypt the data.

Is this algorithm secure, assuming that $E$ and $K$ are kept secret?

  • $\begingroup$ $E$ must be 20 bytes long. $\endgroup$
    – wqw
    Nov 26, 2020 at 17:02
  • $\begingroup$ @wqw Of course. Amended. $\endgroup$ Nov 26, 2020 at 17:04

1 Answer 1


Yes, it is secure to generate the key as long as the $K$ is kept secret. Although the collision of SHA-1 is broken, HMAC is a PRF under the sole assumption that the compression function is a PRF. It is not affected by the collision of the has function.

The security strength of the HMAC is relay on the size of the key. The usual attack is to search for the key $K$.

Keep in mind that, the attacker will go to search for $E$ if $E<K$. In your case, since both are 20 bytes, so brute-forcing $K$ can be faster, though not possible.

  • $\begingroup$ "In your case, since both are 20 bytes, so brute-forcing $K$ can be faster, though not possible." - could you clarify this sentence? $\endgroup$ Nov 26, 2020 at 17:59
  • $\begingroup$ If you brute force the HMAC, you need an HMAC calculation + Decryption per key. If you just brute force the encryption you will only need the decryption per key. $\endgroup$
    – kelalaka
    Nov 26, 2020 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.