What is HMAC and how does it work?

Hashing

To that end, the HMAC algorithm makes use of a cryptographic key and hashing. Hashing turns data into a hash of a constant size. Hashing is also deterministic, meaning that the algorithm produces the same hash for the same input. But the real killer feature of hashing is that there is no way one can obtain the original data from the hash.

This feature of hashing makes it ideal for ensuring data integrity. When data is sent across a communication channel, the data is hashed and the hash is also sent. A recipient can ensure the integrity of the data they received by hashing the received data and checking if the hash is equal to the hash received. MD5 and SHA-256 are two of the popular hash algorithms.

HMAC can prove authenticity too

While ascertaining data integrity is important, verifying authenticity is also important. Here is where HMAC becomes handy since it can both verify the authenticity and integrity of data. Let’s see how it accomplishes this.

How the HMAC algorithm works

First, we choose a hashing algorithm. Depending on the algorithm, the data would be hashed in blocks of a certain size B and a hash of size L is produced. It is relevant to note here that HMAC uses hashing algorithms that are block ciphers. Block ciphers encrypt data in blocks. For example, if we have a stream of 160 bits, then a block cipher might encrypt (or hash) the data in a block of 8 bits. In contrast, a stream cipher encrypts the data bit by bit.

Inner and Outer keys

Now, we need to derive two keys-the inner key and the outer key-from the cryptographic key. The inner key is generated by appending zeroes to the end of the key to make it of size B, and then XORing the key with the ipad-which is 352 bits of zeroes to the key to make the key 512 bits in size. Then, this key is XORed with the byte 0x36 repeated B times. For example, if the block size is 64 bytes (512 bits) and the key size is 20 bytes (160bits), then we append 0x36 repeated 64 times. The resultant key is the inner key.

Then, the outer key is derived by appending zeroes to the original key to make it of size B and then XORing it with the opad-which is 0x5C repeated B times. Now, the fun part begins.

Now, the recipient of the data can use the data that they receive and the key they have, and execute the above algorithm and see if the produced hash matches the code they have received. If they match, then they prove two things.

  1. The input data and the key are both the same since the recipient obtained the same output.
  2. Since the key is the same and since we expect the key to be a secret between the sender and the recipient, it was the sender who actually sent the data.

Summary

Thus, we can summarize the HMAC algorithm as follows:

K -Cryptographic key (zero-padded if needed)

H(K XOR opad, H(K XOR ipad, data))

To get a better understanding of the algorithm, let’s consider an example.

An example

I want to send the data “ Hello World! “ to Bob. I choose the SHA1 hashing algorithm to hash the data. The SHA-1 algorithm hashes data in blocks of 64 bytes. So, the block size B is 64 bytes. The hash produced by this algorithm is 20 bytes. So, L is 20 bytes.

Now, I need to generate a cryptographic key. Since L is 20 bytes, I need to ensure that the key is bigger than L in size. Even though RFC 2104 recommends that the size of the key should not be more than B, i.e., 64 bytes, if the key is longer than L, then we can hash it to produce a key of size L.

Generating a secret key

Let me produce a 1024-bit (128-byte) key using All Keys Generator .

0x2B4B6250655368566B5970337336763979244226452948404D635166546A576E5A7134743777217A25432A462D4A614E645267556B58703273357538782F413F4428472B4B6250655368566D5971337436773979244226452948404D635166546A576E5A7234753778214125432A462D4A614E645267556B5870327335763879

This is in the hexadecimal format with each character representing 4 bits. Here, there are 256 characters producing 256x4=1024 bits.

Hashing the secret key

Now, since my key is bigger than the block size of 64 bytes, I need to hash it. I am going to use this implementation of jsSHA for hashing. Hashing the above key gives me the hash below:

0x5833f34f47af76685334d71be258e5548520593f

Zero-padding the secret key

This hash is also in the hexadecimal format. There are 40 characters producing 40×4, 160 bits (20 bytes). Now, we need to append zeroes to make the size of this key 64 bytes (512bits). We will have to append 512-160=352 bits of zeroes, which is 352/4=88 zeroes in hexadecimal, to the key to make it 64 bytes in size.

0x5833f34f47af76685334d71be258e5548520593f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Creating the ipad

0x36363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636

Deriving the inner key

Next, let’s produce the inner key by XORing the ipad with the key bitwise. We can do this using . The resultant inner key is this:

0x6e05c5797199405e6502e12dd46ed362b3166f093636363636363636363636363636363636363636363636363636363636363636363636363636363636363636

Creating the first hash

Now, let’s append our hexadecimal-encoded data to this key and create a hash using SHA-1.

Our data in hexadecimal (use this to convert string into hexadecimal):

0x48656c6c6f20576f726c6421

Once appended to the inner key:

0x6e05c5797199405e6502e12dd46ed362b3166f09363636363636363636363636363636363636363636363636363636363636363636363636363636363636363648656c6c6f20576f726c6421

The created hash:

0xde33ba343e2e8cccbfd1935f7f8ce96b1eeb8ae2

Creating the opad

0x5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c

Deriving the outer key

Now, let’s XOR it with our zero-padded original key to produce the outer key.

0x46faf131bf32a340f688b47be04b908d97c05635c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c

Producing the HMAC code

Finally, let’s append the hash we obtained by hashing the inner key and the data to the outer key, and hash it.

0x46faf131bf32a340f688b47be04b908d97c05635c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5cde33ba343e2e8cccbfd1935f7f8ce96b1eeb8ae2

The final hash:

0xbfc72c78a8ee233f27b658838990d226d26f5b8a

Now, to test this, you can use the HMAC Demo section of this . Enter the data as a string, and the hexadecimal key and see if we get the above hash as the output.

Originally published at https://www.thearmchaircritic.org on April 20, 2020.

--

--

--

Identity and access management is taking over and is a key enabler to build agile businesses. Open source IAM specifically is becoming a game changer. Learn from IAM experts at WSO2 as to why IAM is all the rage and how it can help empower your enterprise.

Recommended from Medium

Blue Room (TryHackMe)

{UPDATE} Guess the Athlete Wonder Mania: name who's of the pop sports star in this color quiz word…

{UPDATE} Easy Darts 3D Hack Free Resources Generator

Securing Container using Threat Modelling— STRIDE

Europol is afraid that the number of people affected by the cyber attack increase from Monday.

#SpringSecurity: What is the difference between access and refresh token?

Ransomware - What is it and how to protect your business?

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Theviyanthan Krishnamohan

Theviyanthan Krishnamohan

I am a software engineer who is passionate about frontend development, UX design, machine learning, neural networks, blockchain, robotics and IoT.

More from Medium

Extract subdirectory from git repository without losing history

Dynamic Linkage to a z/OS Native Library in Java

Spring Native Image towards maturation

Capabilities of “Sitespeed.io”