Mac and HMAC

About Mac: Use the key + algorithm to generate Digest (also called Mac) and send it to the server.

Message authentication code (hash function with a key): a verification mechanism used by both parties in cryptography to ensure the integrity of message data.

Security depends on the hash function, so it is also called the hash function with a key. The message authentication code is a value obtained based on the key and message digest [hash] and can be used for data source authentication and integrity verification.

 

1. The sender uses the Mac algorithm to calculate the MAC value of the message and sends it together with the message to the receiver.

2. The recipient uses the same mac algorithm to calculate the MAC value of the received message and compares the two.

 

HMAC Introduction: Use the key + algorithm (which must be Hash algorithm, SHA-1, MD5...) to generate Digest (MAC) and send it to the server for authentication. In the use of server authentication, messages are often nonce.

Introduction:

Hash-based message authentication code, which uses a hash algorithm to generate a message digest as the output using a key and a message as the input.

A specific construction for calculating a message authentication code (MAC)
InvolvingCryptographic hash functionIn
Combination with a secretCryptographic key.
As with any mac, it may be used to simultaneously verify bothData IntegrityAnd
TheAuthenticityOf a message. [This is mainly used to verify the sender's identity and message validity. The biggest difference from the message digest is that there is a signature key !]

Method:

HMAC (K, M) = H (k then OPAD) Then H (k then iPad) Then M ))

 

OPAD repeats 0x36, and iPad repeats 0 x 5C]

Two hash keys are generated. No methods have been found for collision.

Steps:

First-Hash: H (Ko XOR iPad | (data to auth ))

Second-Hash: H (Ko xor opad | First-hash)

1. character meaning

H Represents the hash algorithm used (such as SHA-256)

K indicates the authentication password.

B Represents the size of the block processed in H, which is the size of the processed block, rather than the size of the output hash [SHA-1 and SHA-256 B = 64, SHA-384 and SHA-512 B = 128]

KO represents the ciphertext of the hash algorithm [add 0 after the key K to create a string with the length of B. (For example, if K is 20 bytes long and B is 64 bytes long, then it will add 44 zero bytes 0x00 after K)

OPAD repeats B times with 0x5a
Repeated B times with 0x36 for iPad

2. Ko and iPad perform exclusive or operations.

3. Fill the data stream text in the result string in step 1.

4. Use h to act on the data flow generated in step 1.

5. Ko and OPAD perform exclusive or operations.

6. Fill in the result of step 1 in the result of step 2.

7. Use h to act on the Data Stream Generated in step 1 and output the final result.

 

Application:

A typical HMAC application is used in challenge/response authentication.

 

 

1. The client sendsVerification request

2. The server generates a requestRandom NumberAnd transmitted to the client through the network (this is a challenge)

3. The client provides the random number received to epassEpassUseThis random numberAndKeys stored in epassProceedHMAC-MD5 operationsAnd get a result as the authentication evidence to the server (this is the response ).

4. At the same time, the server also usesThis random numberAndThis customer key stored in the server databaseProceedHMAC-MD5Operation. If the calculation result of the server is the same as that returned by the client, the client is considered as a legal user.

 

Security:

The HMAC algorithm is more like an encryption algorithm. It introduces a key, and its security is not completely dependent on the hash algorithm used.

 

1. The key used is agreed by both parties in advance and cannot be known by any third party. Only the random number that can be obtained as the challenge and the HMAC result of the response cannot be used to calculate the key based on the two data. Because you do not know the key, you cannot create consistent responses.

2. An important difference between HMAC and general encryption is that it is "instantaneous", that is, authentication is only valid at the time.