C
HMAC
Learn message authentication with HMAC.
What is HMAC?
HMAC (Hash-based Message Authentication Code) produces a message authentication code using a hash with a key. The receiver computes the same code with the same key and compares; if equal, the message is unchanged and the sender is authentic.
In OpenSSL it is computed in a single call: HMAC(EVP_sha256(), key, keylen, data, datalen, digest, &len). key is the secret, data is the message. Unlike a plain hash, HMAC cannot be verified without the key; so it provides both integrity and authenticity. For testing, printing a fixed done message is enough.
The HMAC pattern
HMAC is computed in a single call: unsigned char digest[EVP_MAX_MD_SIZE]; unsigned int len = 0; HMAC(EVP_sha256(), "key", 3, (const unsigned char *)"msg", 3, digest, &len);. digest is the 32-byte authentication code.
The receiver computes the same code with the same key and message; compares with memcmp. If equal, the message is authentic. For testing, printf("hmac done\n") is enough; the code itself is environment-independent but printing byte values is complex. In production you show the code as hex.
Exercise Compute HMAC
Declare unsigned char digest[EVP_MAX_MD_SIZE]; unsigned int len = 0;. Compute with HMAC(EVP_sha256(), "key", 3, (const unsigned char *)"msg", 3, digest, &len);. printf("hmac done\n");.
Show example solution
#include <stdio.h>
#include <openssl/hmac.h>
int main(void) {
unsigned char digest[EVP_MAX_MD_SIZE];
unsigned int len = 0;
HMAC(EVP_sha256(), "key", 3, (const unsigned char *)"msg", 3, digest, &len);
printf("hmac done\n");
return 0;
}
Test yourself
-
HMAC call
HMAC(____, "key", 3, (const unsigned char *)"msg", 3, digest, &len);
Show answer
HMAC(EVP_sha256(), "key", 3, (const unsigned char *)"msg", 3, digest, &len);
-
Match HMAC parts
- HMAC
- Auth code
- key
- Secret
- EVP_sha256
- Hash algorithm
- memcmp
- Compare
-
What is HMAC used for?
- Message authentication
- Encryption
- Compression
- Random numbers
Show answer
Message authentication — HMAC is used for message authentication and integrity.
Next lesson: AES
