# When, where, and how to use HMAC

This question may seem like a duplicate of some others, namely this one, but even though that question asked when and how to use HMAC, the answers only addressed what HMAC was and why/how it worked.

So, my questions are:

• When is it appropriate to use HMAC? If I'm encrypting files on my local computer? If I'm encrypting and syncing files to a server? If I'm sending messages to Bob? When is it not needed?
• Simply, what is the recommended algorithm for generating a HMAC? I've seen the Wikipedia page, which does something strange with padding, and have read about HMACs in 'Practical Cryptography', where it says a and b are "specified constants" without going into detail about the constraints on these constants.
• The book previously used h(h(m)||m) to prevent length extension attacks, then later defined a different algorithm for HMACs. Why was the former not appropriate for HMAC?
• Are you sure the book used h(h(m)||m)? There is no key in there? – mikeazo Jul 28 '16 at 13:02
• The book wasn't discussing HMAC when it used that. It was simply defining a hash function that was immune to length extension attacks. I'm simply commenting on the fact that the HMAC algorithm is quite different to this one. – Awn Jul 28 '16 at 13:05
• – fgrieu Jul 28 '16 at 13:23

When is it appropriate to use HMAC? If I'm encrypting files on my local computer? If I'm encrypting and syncing files to a server? If I'm sending messages to Bob? When is it not needed?

I think the best answer here is that you're mixing levels of abstraction. Since you've been reading Ferguson et al's book, I would refer you to their material on the concept of the secure channel—an API that provides concepts at a level more appropriate to scenarios that you are describing here (even though the one they show may not ideal for all of them). Indeed, in their book HMAC is applied in the context of how to implement a secure channel so that clients that need secure communications don't have to think about HMAC (or nonce reuse or anything of the sort).

The second point is that two of the big, hard-learned lessons of the past 20 years are:

1. The importance of authenticated encryption;
2. How easy it is to get it wrong!

So another answer to your question is that, by default, you should be using authentication everywhere unless you can prove that you don't need to. That doesn't mean use HMAC specifically (again, you're mixing levels of abstraction!), but it does mean that nearly all encryption really ought to be authenticated encryption, and that it should not be ad hoc—it should be a well-studied construction, from a well-audited library function.

• Any idea on why ipad and opad are used? – Awn Jul 29 '16 at 20:55
• @Aurora: I don't understand them well enough to do much more than point you at the original source. Pages 13 and 14 are the most relevant bits, but you'd want to at least grasp the rudiments of what comes before that in the paper. – Luis Casillas Jul 29 '16 at 22:59

When is it appropriate to use HMAC? If I'm encrypting files on my local computer? If I'm encrypting and syncing files to a server? If I'm sending messages to Bob? When is it not needed?

Encryption alone only provides confidentiality. Any time you need to be certain of authenticity and integrity of data, you should use an additional construct to achieve that level of security. HMAC is one such construct, but there are others. So, it is appropriate to use HMAC when you need the additional security it provides and when an AEAD mode isn't a better choice (e.g., not available in your library, no hardware support, etc).

Simply, what is the recommended algorithm for generating a HMAC?

The details can be found in FIPS 198-1. They specify: $\operatorname{HMAC}(K, \text{text}) = H((K_0 \oplus \text{opad} )|| H((K_0 \oplus \text{ipad}) || \text{text}))$. For full details, see the spec. It isn't very long.

The book previously used h(h(m)||m) to prevent length extension attacks, then later defined a different algorithm for HMACs. Why was the former not appropriate for HMAC?

The former construction (h(h(m)||m)) has no key, so it isn't really an authentication code. Without a key, anyone can compute it.

• Regarding the algorithm, I've already seen the spec and the Wikipedia page. I should have been more clear: I was looking for en explanation about that construction, what it is, why opad and ipad are used, how it protects against what, etc. And the final question was not about HMAC directly; I know that it doesn't have a key, but I was trying to emphasise on the second question. – Awn Jul 28 '16 at 13:20
• Have you seen this question? It would seem to answer at least some of your questions. – mikeazo Jul 28 '16 at 13:22