Is reverse engineering SHA256-HMAC function possible?

Asked Feb 14 '19 at 20:27

Active Feb 14 '19 at 20:49

Viewed 746 times

Assume HMAC function is used to generate a 6-digt integers time-based onetime password. As follows:

$$K_h =\operatorname{HMAC}(k,t) = H((k\oplus\text{opad})\mathbin\| H((k\oplus\text{ipad})\mathbin\|t))$$

Then:

$$T=K_h \bmod 10^6$$ where $t$ is time, $k$ is a secret key, and $T$ is a one-time password.

Now assume that an attacker knows t and can observe unlimited number of one-time passwords. Is it possible for him to solve for the secret key ($k$)? References would be nice.

edited Feb 14 '19 at 20:49

fgrieu

140,762
12
307
587

asked Feb 14 '19 at 20:27

Crankdat

Welcome to Cryptography. I've edited your question. Please check the equations. What is $T$, the password? Why don't you use Key Derivation Functions? – kelalaka Feb 14 '19 at 20:35
For an argument of security even if the full $K_h$ leaked, see Mihir Bellare: New Proofs for NMAC and HMAC: Security Without Collision-Resistance, in proceedings of Crypto 2006. – fgrieu Feb 14 '19 at 20:48
2

Possible duplicate of SHA256 HMAC brute force with chosen plaintext attacks @fgrieu I did not find something important to add your previous answer even after 5 years. – kelalaka Feb 14 '19 at 21:22
I agree with kelalaka here, this is a dupe. The change of base and shortening of the hash bits (to about 20 bits) doesn't change anything in that regard. So we have to close this question. On the bright side: you have your answer. Don't forget to vote up or comment here if anything is not clear. – Maarten Bodewes Feb 14 '19 at 22:15

Is reverse engineering SHA256-HMAC function possible?

0 Answers0