The Cryptography Concept Journey — HMAC (Hashed Based Message Authentication Code)

HMAC (Hashed Based Message Authentication Code) is calculated by applying a standard cryptographic hash function (like SHA-256) to both the message data and a shared secret key. This results in an authentication code that verifies the message hasn’t been tampered with and comes from a trusted sender who possesses the same secret key. While similar to digital signatures in purpose, HMACs only use a single shared (symmetric) key. This is different from the public/private key pairs (asymmetric) used in digital signatures (https://www.jscape.com/blog/what-is-hmac-and-how-does-it-secure-file-transfers).

Overall, HMAC is implemented (based on RFC 2104) by taking a secret key (“K”) and performing a two stage cryptographic hash calculation using an existing hash function (“H”). The message text (“m”) is first hashed internally with a padded version of the key (“K” XOR “ipad”). The resulting hash is then hashed externally with another padded version of the key (“K” XOR “opad”) to produce the final MAC — as shown below (https://en.wikipedia.org/wiki/HMAC). This nested structure ensures message integrity and authenticity, leveraging the speed of existing hash functions while adding secret key dependency for security. For efficiency, key derived padded values can be precomputed and used as the hash function’s initial value (IV) for faster processing, particularly with short messages (https://datatracker.ietf.org/doc/html/rfc2104).

Lastly, HMAC can be leveraged to serve two critical security functions. Primarily, ensure message authenticity and integrity by generating a verifiable tag for data such as (but not limited to) JWTs (JSON Web Tokens) or sensitive financial information for confirming that the message is unaltered and comes from a trusted source. Secondly, HMACs can be used as components in secure KDFs (Key Derivation Functions), which is essential for deterministically generating multiple strong cryptographic keys from a single master secret (https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html).

See you in my next writeup ;-) You can follow me on twitter — @boutnaru (https://twitter.com/boutnaru). Also, you can read my other writeups on medium — https://medium.com/@boutnaru. You can find my free eBooks at https://TheLearningJourneyEbooks.com.

https://en.wikipedia.org/wiki/HMAC