PGP digital signature vs SHA256 HMAC Comparison First let me admit that I am not a mathematician or a cryptographer.
I am responsible for assisting in making a recommendation on a project that is consolidating payment processes within a company's internal network.

We have payment files which are being created by various applications; Several legacy applications are using PGP to digitally sign the payment files (sign only - no encryption. The hash algorithm is SHA1 and the digital signature algo is RSA 1024).  Several newer applications are protecting the payment files using SHA256 HMAC (using a 256 bit random private key).

Regardless of whether we decide on public key cryptography (PGP) or secret key cryptography (HMAC), we will replace the keys periodically and feel reasonably assured that we can protect the private key and passphrase or the secret key for HMAC.

The question has been raised questioning the relative strength of SHA256 HMAC vs. PGP digital signature.  We know that the PGP digital signature is appended to each payment file, and network admins and others can easily copy signed payment files (but they cannot get to the PGP keys folder nor the passphrase).  Similarly, the SHA256 HMAC hashtag value and the original plaintext payment file can be accessed by admins, but not the secret key.

Given that in both sets of applications a potential adversary can get the original plaintext and the digital signature or HMAC Hashtag, which of these two scenarios would be least vulnerable to brute force or other attacks that attempt to derive the private or secret key?  Based on current computing power, how long should we have reasonable assurance that either technology would be relatively secure?
PGP [1024-bit] digital signature vs SHA256 HMAC Comparison...


First, you can compare asymmetric and symmetric algorithms. A 1024-bit asymmetric key provides about 80-bits of security. A SHA256 HMAC provides about 128-bits of security. With all other things being equal, the HMAC is stronger.

Second, I believe PGP (or is it GnuPG) uses Lim-Lee primes and they don't provide the prime factorization. So you can't test that they are any good in practice.

Third, the random key used in the HMAC may not be random. And the random numbers used to generate the asymmetric keys might have problems too. Randomness is a lot like bugs. To borrow from Dykstra, you can test for the absence of randomness, but the presence of it.

Fourth, both systems sound like they might be subject to forgeries. So you might want to ensure surreptitious forwarding, replays and other tricks don't occur.

Fifth, ... (favorite threat here).

Also, storing the private key or the symmetric key is the Unattended Key Storage problem described by Gutmann in his book Engineering Security. Its a problem without a solution.




  other attacks that attempt to derive the private or secret key?


OK, this is easier. The adversary will not attempt to break the crypto. They will go around it. They will go around it by breaking into the system, getting root, and then reading the key from the filesystem.

There are only two crypto attacks I am aware. First was the factoring of the TI Signing Key, and second was the Flame malware. The TI factoring occurred on a 512-bit asymmetric key; while the Flame malware took advantage of MD5 collisions on Microsoft CA certificate.

Breaking into the system is a much more cost effective attack. It will probably start by phishing one of the ladies in HR or Accounts Receivable. That's how it started with with a few high profile attacks, like RSA Data Securities and one of the other big ones, like Sony (IIRC).




  Based on current computing power, how long should we have reasonable assurance that either technology would be relatively secure?


I think 80-bits of security is within reach of a few well funded adversaries. But out of reach of most others.

128-bit security will likely never be within reach of anyone.