why HMAC (Keyed-Hashing for Message Authentication)?

From: Bernhard Kuemel (darsie_at_gmx.at)
Date: 12/19/03 

Date: Fri, 19 Dec 2003 15:19:11 +0100

Hi!

What is the advantage of HMAC over simply passing
hash(strcat(key,message)) along with the message?

RFC2104, HMAC:

                     H(K XOR opad, H(K XOR ipad, text))

    Namely,

     (1) append zeros to the end of K to create a B byte string
         (e.g., if K is of length 20 bytes and B=64, then K will be
          appended with 44 zero bytes 0x00)
     (2) XOR (bitwise exclusive-OR) the B byte string computed in
step
         (1) with ipad
     (3) append the stream of data 'text' to the B byte string
resulting
         from step (2)
     (4) apply H to the stream generated in step (3)
     (5) XOR (bitwise exclusive-OR) the B byte string computed in
         step (1) with opad
     (6) append the H result from step (4) to the B byte string
         resulting from step (5)
     (7) apply H to the stream generated in step (6) and output
         the result 

-- 
Webspace; Low end Serverhousing ab 15 e, etc.: http://www.bksys.at
Linux Admin/Programmierer: http://bksys.at/bernhard/services.html

Relevant Pages

  • Re: Question about design, defmacro, macrolet, and &environment
    ... "Expects to find the literal string on the stream." ... (defun send (string &optional stream) ... (declaim (inline make-adjustable-string)) ...
    (comp.lang.lisp)
  • Re: Strange problem when not in debugger
    ... private string huidigWeb; ... int buffLength = 2048; ... // Opens a file stream to read the file to be uploaded ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Strange problem when not in debugger
    ... private string huidigWeb; ... int buffLength = 2048; ... // Opens a file stream to read the file to be uploaded ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: ReplacerStream
    ... string, do a replace on that string and create a stream again to be ... If those are problems, and you are looking just for a single string, it seems to me that you could just read the stream one character at a time, checking to see if it matches the current character in your search string. ...
    (microsoft.public.dotnet.framework)
  • Re: HTTP Object and Retrieving HTML Programatically
    ... I had to hardcode some query string and form post values, ... chunks defined by the buffer size ... //create a stream reader grabbing text we get over HTTP ... while (workingbuffersize> 0) ...
    (microsoft.public.dotnet.framework.aspnet)