Key size for HMAC-SHA256 After reading a bunch of past stack exchange posts like this one and RFCs 5869, 2104, and 4868 I felt comfortable that a 32-byte key was sufficient for HMAC-SHA256.  However, I am implementing my code in C# and someone pointed out to me that the Microsoft HMAC-SHA256 documentation recommends a 64-byte key:


  The key can be any length. However, the recommended size is 64 bytes.


Is there any good reason to use a 64-byte key instead of a 32-byte key?
Short answer: 32 bytes of full-entropy key is enough.

Assuming full-entropy key (that is, each bit of key is chosen independently of the others by an equivalent of fair coin toss), the security of HMAC-SHA-256 against brute force key search is defined by the key size up to 64 bytes (512 bits) of key, then abruptly drops to 32 bytes (256 bits) for larger keys; that's because in the later case, the key is hashed to 32 bytes before use. It is an argument to use a 64-byte key: it's the size giving the maximum resistance to brute force key search; and beside the key being harder to manage than a 32-byte one, using 64 bytes does not harm security, and leaves speed almost unchanged (there is no additional hashing done).

On the other hand, 256 bits of security is way more than enough for anything even vaguely foreseable, including quantum computers. If MACs are computed at a rate of $2^{88}$ per year (requiring hashing effort slightly superior to what's devoted to bitcoin mining), and they could be checked among known MACs for $2^{32}$ different keys at that rate (arguably requiring more additional effort than hashing), and we wanted residual odds of $2^{-35}$ that any key is found within 32 years, 160 bits of key entropy is enough, ignoring quantum computers.

HMAC-SHA-256 is designed for 256-bit (32-byte) cryptographic resistance in mind, with no strong argument that using a key with more entropy improves the security; beyond that, there is no assurance given by the best security proof available (Mihir Bellare: New Proofs for NMAC and HMAC: Security without Collision-Resistance, with extended abstract in Crypto 2006 Proceedings). 
Thus if the key is full-entropy, there is no strong argument to use a key of more then 32 bytes.

If the key is not known to be full-entropy, there is an obvious, reasonable argument that large keys are necessary. For example, if the key was a diceware passphrase, which has an entropy of $5\log_2(6)\approx12.9$ bit/word, there needs to be 20 words in the key, that is up to 139 characters (with 6 characters per word, and space between words), to reach 256 bits of entropy.