When, where, and how to use HMAC

Question

This question may seem like a duplicate of some others, namely this one, but even though that question asked when and how to use HMAC, the answers only addressed what HMAC was and why/how it worked.

So, my questions are:

• When is it appropriate to use HMAC? If I'm encrypting files on my local computer? If I'm encrypting and syncing files to a server? If I'm sending messages to Bob? When is it not needed?
• Simply, what is the recommended algorithm for generating a HMAC? I've seen the Wikipedia page, which does something strange with padding, and have read about HMACs in 'Practical Cryptography', where it says a and b are "specified constants" without going into detail about the constraints on these constants.
• The book previously used h(h(m)||m) to prevent length extension attacks, then later defined a different algorithm for HMACs. Why was the former not appropriate for HMAC?

Answer 1

When is it appropriate to use HMAC? If I'm encrypting files on my local computer? If I'm encrypting and syncing files to a server? If I'm sending messages to Bob? When is it not needed?

I think the best answer here is that you're mixing levels of abstraction. Since you've been reading Ferguson et al's book, I would refer you to their material on the concept of the secure channel—an API that provides concepts at a level more appropriate to scenarios that you are describing here (even though the one they show may not ideal for all of them). Indeed, in their book HMAC is applied in the context of how to implement a secure channel so that clients that need secure communications don't have to think about HMAC (or nonce reuse or anything of the sort).

The second point is that two of the big, hard-learned lessons of the past 20 years are:

1. The importance of authenticated encryption;
2. How easy it is to get it wrong!

So another answer to your question is that, by default, you should be using authentication everywhere unless you can prove that you don't need to. That doesn't mean use HMAC specifically (again, you're mixing levels of abstraction!), but it does mean that nearly all encryption really ought to be authenticated encryption, and that it should not be ad hoc—it should be a well-studied construction, from a well-audited library function.

Some good reading:

• http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
• Why should I use Authenticated Encryption instead of just encryption?

Answer 2

When is it appropriate to use HMAC? If I'm encrypting files on my local computer? If I'm encrypting and syncing files to a server? If I'm sending messages to Bob? When is it not needed?

Encryption alone only provides confidentiality. Any time you need to be certain of authenticity and integrity of data, you should use an additional construct to achieve that level of security. HMAC is one such construct, but there are others. So, it is appropriate to use HMAC when you need the additional security it provides and when an AEAD mode isn't a better choice (e.g., not available in your library, no hardware support, etc).

Simply, what is the recommended algorithm for generating a HMAC?

The details can be found in FIPS 198-1. They specify: $\operatorname{HMAC}(K, \text{text}) = H((K_0 \oplus \text{opad} )|| H((K_0 \oplus \text{ipad}) || \text{text}))$. For full details, see the spec. It isn't very long.

The book previously used h(h(m)||m) to prevent length extension attacks, then later defined a different algorithm for HMACs. Why was the former not appropriate for HMAC?

The former construction (h(h(m)||m)) has no key, so it isn't really an authentication code. Without a key, anyone can compute it.