Brute forcing an HMAC Given current technology such as GPUs and GPU cracking software I was wondering if anyone has an idea on how long it would take to brute force the key used to derive an HMAC?
CodeInChaos has it right about the infeasbility of this against a random key; however, lets run the numbers to see how extremely correct he is:

Let us assume we are attacking HMAC-MD5 within TLS; this has a 128 bit key.

The fastest GPU server (actually, it has 25 GPUs internally) can test about 400 billion keys per second.

Let us assume that we, having a huge budget, have assembled 1 million of the above units; that means that we can test $4 \times 10^{17}$ keys per second; sounds impressive.

However, it'll take an average of $2^{127}$ keys tested before we recover the HMAC-MD5 key; at $4 \times 10^{17}$ keys per second, that'd be $4 \times 10^{20}$ seconds, or about $10,000,000,000$ years.  I'd call that somewhat impractical; if nothing else, the sun will become a red giant and destroy our set up before we're likely to find a result.

It gets even worse if we talk about HMAC-SHA1; that uses 160 bit keys; that increases the amount of time we'd expect to take by about 4 billion.

Yes, if what we're talking about is a key derived from a password, GPUs can be used.  However, when we're talking about random keys, they don't come close to scratching the algorithm.