Salesforce recently announced they are moving away from HMAC SHA256 to RSA SHA256.

Why did they make that move? Any technical factors?

Is HMAC really easy to break?

enter image description here

PS: I am not a security expert.


1 Answer 1


From a security standpoint, HMAC-SHA256 is exceptionally secure, so the move is unlikely to relate much to cryptographic security unless they were using the construction incorrectly, which is improbable.

I freely admit that I know almost nothing about Salesforce, but I can guess at the rationale behind the decision: since HMAC is a symmetric primitive, both sides of a channel need to have a shared, private key. With an asymmetric primitive like RSA, on the other hand, the verifying party needs only the public key (certificate), so the private key is held only by the party who needs to sign.

This means that a Salesforce employee could not, as a hypothetical scenario, steal an authentication key and masquerade as a customer without changing the codebase (which often leaves an audit trail), since the private key is held only by the client. The tradeoff is that RSA is much slower than HMAC, but that doesn't always matter.

Now, as I said, I know almost nothing about Salesforce, so I don't know if this was their thinking or not. But coming from a purely cryptographic POV, that would be the most logical explanation, I think. That said, if you are a customer, you might ask them — maybe you'll get an interesting response from an engineer.

  • 1
    $\begingroup$ We are a customer but don't have any contacts to get an answer on this. You logic seems the most plausible one. $\endgroup$
    – so_mv
    Commented Jan 7, 2014 at 1:49
  • $\begingroup$ Perfect info. Thanx! $\endgroup$ Commented Nov 12, 2016 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.