Equivalent key size between HMAC and AES? I have seem comparison between AES and RSA, e.g., AES 128 bit key is equivalent to RSA modulus 3072 bits. Is there such comparison between AES key size and HMAC?
Well, there are two potential key recovery attacks against HMAC (assuming a reasonable hash function):


Brute force the key; that is, take a valid (Message, MAC) pair, and try every possible key, and look for a key that gives that MAC for that Message
Brute force the internal hashing state immediately after processing the IPAD/OPAD; here, you would take a valid (Message, MAC) pair, and try every possible key, and look for a key that gives that MAC for that Message


Now, for first attack would take $O(2^k)$ time (for a key size of $k$); the second attack would take $O(2^{2n})$ time (if the hash function had an internal state size of $n$ bits).

With realistic key sizes and hash functions, $2^k &lt; 2^{2n}$; hence the best attack is an exhaustive search of the key space; this gives us the same approximate strength as AES for a given key size.