# Finding the Input if Hash Value, Hash Function, and Key are known

Let's assume that we have a hash value $$h$$ is calculated by using HMAC-SHA256.

We have the key $$k$$. We also know some information about the input:

• It contains a pattern like 15 numbers where first 7 are known;

Question: Is it possible to find at least one input $$m$$ such that $$h = \operatorname{HMAC-SHA256}(k,m)$$ without generating all possible patterns?

• is it HMAC-SHA256? are we going to guess the hash value or input? since you say you know a hash – kelalaka Nov 28 '18 at 7:22
• Is there actually a hash that just called "256" or just a typo? You've no luck if it's actually pre-image resistant. – DannyNiu Nov 28 '18 at 8:11
• @kelalaka we are going to guess the input. I'm the one who posted at first :) – jykill Nov 28 '18 at 9:46
• It appears that you have accidently created two accounts, please now follow the instruction in our help center for this situation to resolve this issue. – SEJPM Nov 28 '18 at 19:11

First of all, HMAC is not exactly a hash function. The Wikipedia clearly states that;

In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key.

In case of HMAC-SHA256, the hash function in the HMAC is SHA256.

Remember that, Cryptographic hash functions are not invertible functions, and we require that they have pre-image, second pre-image, and collision resistance.

There is still an ambiguity in the question; I'll try to answer in two ways.

1. The input is exactly 15 numbers where first 7 are known.

In this case, the input space is limited, 8 unknown numbers this makes $$10^8 \approx 2^{27}$$ and this input space can be tested very quickly even with a raspberry pi.

What about finding a $$m$$ without generating the pattern. Actually, this means that, you are looking for pre-image for HMAC-SHA256. There is no known attack for HMAC. For alone SHA-256 there are pre-image attacks, for example:

This will be infeasible. Note that practical collision attacks for SHA-256/512 is possible with reduced rounds 26/64 and 27/80, respectively.

2. The input contains 15 numbers where first 7 are known.

In this case, we have a structure as;

    ppp...pppfffffffrrrrrrrrsss...sss


Knowing some part of the input may help with testing each value. Unfortunately, there is no information about the prefix (p) size and suffix (s) size. So, one has to consider cases.

What about finding a $$m$$ without generating the pattern. The pre-image status is the same as in the first case.

• HMAC with a fixed, known key (i.e. $m \mapsto HMAC_k(m)$) is a cryptographic hash function if the underlying hash is. (A MAC with a fixed key is not a hash function in general: if you know the key it may be possible to construct collisions or calculate inverses.) – Gilles 'SO- stop being evil' Dec 29 '18 at 10:15