HMAC (source code)
= HMAC
{c}
{title2=$\operatorname{HMAC}_K(m)$}
\b[HMAC] constructs a <message authentication code> from a <cryptographic hash function> and a shared secret key. For a hash $H$ with input block size $B$ bytes, normalize the key to a $B$-byte string $K_0$: first hash it if it is longer than $B$, then pad with zero bytes. The construction is
$$
\operatorname{HMAC}_K(m)=H\bigl((K_0\oplus\mathrm{opad})\mathbin\Vert
H((K_0\oplus\mathrm{ipad})\mathbin\Vert m)\bigr).
$$
Here $\oplus$ is bytewise <exclusive or>, $\Vert$ is <concatenation of strings>, `ipad` repeats byte `0x36`, and `opad` repeats byte `0x5c`. The inner and outer keyed hashing stages are part of the construction, rather than interchangeable placements of a key beside a message.<HMAC: Keyed-Hashing for Message Authentication (RFC 2104)>[Section2, definition of HMAC]{ref}
A concrete interoperability example uses <SHA-256>, a member of <SHA-2>. Its block size is64 bytes while its full digest is32 bytes. With a key of20 `0x0b` bytes and the ASCII message `Hi There`, the hexadecimal tag is `b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7`.<Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 (RFC 4231)>[Sections4.2 and4.4, Test Case1 and SHA-256 block size]{ref}
The receiver recomputes the tag using the shared key and checks the received tag. <HMAC> authenticates the message without concealing its contents; <encryption> is a separate operation. Because both parties know the key, both can make valid tags. A valid tag also remains valid when the same authenticated message is sent again, so replay handling belongs to the surrounding <cryptographic protocol>.
<HMAC>'s original analysis and design are due to <Mihir Bellare>, <Ran Canetti> and <Hugo Krawczyk>.<Keying Hash Functions for Message Authentication by Mihir Bellare, Ran Canetti and Hugo Krawczyk>[Title page and introduction, keyed hashing constructions and security analysis]{ref}
Back to article page
