Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

DISCLAIMER: I don't know a lot about cryptography.

I was reading about the Hashlet, and I had a couple questions. The Hashlet is described as:

SHA256 hardware device with a hardware RNG, and protected key storage on an easy to mount board for the BeagleBone Black or Raspberry Pi.

...

The Hashlet provides an easy way to add secure authentication to your BeagleBone Black or Pi. It has hardware protected key storage and performs the SHA-256 algorithm in the chip. Using a shared secret key, it adds authentication and message integrity to your embedded project.

This means that another server, application, or a remote device can validate that a message originated from your Hashlet.

Correct me if I'm wrong, but this means that the Hashlet does NOT encrypt messages. It only hashes the message and attaches a signature at the end that contains the output of the SHA function.

This may be totally wrong, but I got stuck here. How is the message verified? What does the server have to do with the private key to know that the message is authentic? Does it re-hash the text?

Any help is appreciated- I'd love to expand my knowledge of cryptography to figure out how this works.

share|improve this question

put on hold as too broad by e-sushi, archie, poncho, otus, DrLecter yesterday

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Trying to explain message verification and authentication from scratch in an answer here would be like trying to write a book on a post-it, meaning – as it stands – your question is way too broad. And if you’re just interested how Hashlet does it, I really have to ask: What research have you done? After all, the Hashlet website itself already explains what Hashlet does and how it handles MACs and co.! –  e-sushi 2 days ago
    
@e-sushi I did a bit of research on message verification and authentication and I think I get what's going on. That link is super helpful, though, I didn't find that yet :) Thanks. –  Blue Ice yesterday
add comment

1 Answer 1

Please review how message authentication codes and HMAC work. They are covered in standard resources (e.g., Wikipedia, crypto textbooks, search on this site). They are just saying that Hashlet can be used to compute a HMAC, which indeed does not encrypt; it provides message authentication.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.