2
$\begingroup$

I would like to make sure I understood HMAC. Wikipedia declares it like:

$$\operatorname{HMAC}(K,m)=H((K\oplus\text{opad})||H((K\oplus\text{ipad})||m))$$

If I want to use HMAC-SHA1, am I correct to say that:

  • Let's say I take key length of 16 bytes. Does it mean that according to Wikipedia I must pad the key with zeros from right up to 512 bits? (block length of SHA1)
  • $\text{opad}$ must be a 512 bit value, like: 0x5c...5c (512 bits)?
  • $\text{ipad}$ similarly: 0x36...36 (512 bits long)?
  • What to do with $m$ if its length is not 512 bits?
  • What is the recommended length of actual key and what is the recommended way to generate it?
  • Is it bad idea to implement HMAC myself, if I have implementation of SHA1?
Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ Last Question: While HMAC is simple, care still needs ton be taken while implemting it (to ensure constant time comparisons, to ensure key-wiping, to get the padding right, etc.). The recommended key length is one block length or the minimal unguessable length (i.e. 128-bit to 256-bit). Generation: randomly generated and either pre-shared or derived from common secret (see Diffie-Hellman) $\endgroup$
    – SEJPM
    Feb 17, 2016 at 20:50
  • $\begingroup$ @SEJPM:is there any rule how to generate preshared secret? Hope someone else will answer other points. $\endgroup$
    – user31507
    Feb 17, 2016 at 20:56
  • $\begingroup$ I'm not confident to reliably answer the other points (RFC 2104 may help though). As for the generation, you'd just query your favorite RNG to generate a random string of the desired length (or derive it cleverly from a pass {word,phrase}) $\endgroup$
    – SEJPM
    Feb 17, 2016 at 21:00
  • $\begingroup$ @SEJP: That RNG I should take somewhere from openssl etc? Will wait till someone else covers other points $\endgroup$
    – user31507
    Feb 17, 2016 at 21:01

1 Answer 1

Reset to default
3
$\begingroup$
  • let's say I take key length of 16 bytes. Does it mean that according to wiki I must pad the key with zeros from right up to 512 bits? (block length of SHA1)

Yes.

  • opad must be a 512 bit value, like: 0x5c5c5c…5c5c....5c (512 bits)?

Yes.

  • ipad similarly: 0x363636…3636 (512 bits long)

Yes.

  • what to do with m if its length is not 512 bits?

This should not be relevant for the HMAC implementation itself, since the hash function is the cryptographic primitive responsible for effectively processing the message (of arbitrary length).

  • what is the recommended length of actual key? and recommendation for key generation?

Before using it, HMAC will pad the provided key material with 0's until it reaches the block size. The size (and the quality!) of this key material depends on how much security your implementation is targeting. Note that RFC2104 "strongly discourages" the usage of keys of shorter length than the hash output (see comment from otus), which for SHA-1 would be 160 bits. As SEJPM mentioned in his comment to the question, the key can be either generated at random or pre-shared/derived from a common secret (see Diffie-Hellman).

is it bad idea to implement HMAC myself, if I have implementation of SHA1?

It might be a good exercise if you want to get familiar with cryptography implementation details. However if you need an HMAC implementation in the scope of a project for example, you may prefer to use an extensively tested and validated implementation (e.g., open source cryptography libraries).

Improve this answer
$\endgroup$
2
  • 2
    $\begingroup$ Regarding key length, the RFC says keys shorter than the hash output are "strongly discouraged". NIST allows anything that is at least the desired security level. $\endgroup$
    – otus
    Feb 17, 2016 at 21:21
  • $\begingroup$ @otus: Thanks, I have updated my answer with the remark on the RFC recommendation. $\endgroup$
    – mczraf
    Feb 17, 2016 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.