Cryptographic APIs use to allow for calculating HMAC-SHA256 signatures for message m and key k with something like HMAC-SHA256(k,m). However, I found out that none of them (unless I overlooked it) allows for calculating the MAC from the hash of the message, and key. IOW, the API to calculate HMAC knowing only h=H(m) and k is not available.

For example, Java provides the Mac class, but only allows for a buffer to be fetched so that the output (the HMAC-SHA256) is calculated.

Does this cryptographically makes sense, and if yes, any clue on how to implement this in Java?

  • 1
    $\begingroup$ Do you mean calculating HMAC(H(m), k) or calculating HMAC(m, k) when given only h=H(m) and k? $\endgroup$
    – otus
    Aug 29 '16 at 17:33
  • $\begingroup$ Oh, yes, the latter one, given only h=H(m) and k. $\endgroup$
    – SCO
    Aug 29 '16 at 18:18
  • 2
    $\begingroup$ The question does not make sense: H(m) cannot be used to calculate HMAC(m, k). You would instead want H(kpad || m), where kpad is derived from key. For details of computing HMAC (e.g. how kpad is derived) see RFC 2104 or en.wikipedia.org/wiki/Hash-based_message_authentication_code $\endgroup$
    – user4982
    Aug 29 '16 at 18:36
  • 3
    $\begingroup$ @user4982: do you want to supply that as an answer? I don't think anyone can come up with a better response than 'no, you can't do that'. You might also spell out the reason that it is impossible (and not just infeasible); that two strings might have the same SHA256 hash (yes, they must exist, collision resistance just means they're hard to find) and have different HMAC-SHA256's (based on the key) $\endgroup$
    – poncho
    Aug 29 '16 at 19:13
  • $\begingroup$ I'm confused by the comment "only allows a buffer to be fetched". I don't see how the method of giving the input relates to the properties of the algorithm. If you're thinking about streaming the input to HMAC, it is possible (as can be seen from the definition). $\endgroup$
    – ilkkachu
    Aug 30 '16 at 8:16

No, knowing the SHA-256 hash of an arbitrary message, and a key, it is not possible to compute the HMAC-SHA-256 for that message and key; that's because in HMAC, something dependent on the key is put in front of the message before hashing the message.

Addition: if what's asked was possible, then a break of SHA-256 allowing to find collisions would be a death blow for HMAC-SHA-256 (the HMAC for messages colliding per SHA-256 would be identical for any key). By contrast, we have excellent hope that the HMAC construction would provide enough protection to keep HMAC-SHA-256 practically safe. There's the precedent of HMAC-MD5, which remains unbroken even though MD5's collision resistance is trounced; and the theoretical security argument made by Mihir Bellare in New Proofs for NMAC and HMAC: Security without Collision-Resistance.

Independently, on the same line: knowing the SHA-256 hash of an arbitrary key of more than 64 bytes, and a message, it is possible to compute the HMAC-SHA-256 for that message and key; that's because by definition of HMAC, for keys larger than the message block size (64 bytes for SHA-256), the first operation made with the key is to replace it by its hash.

Note: in this answer, arbitrary excludes guessing a low-entropy value from its hash.

  • 1
    $\begingroup$ ... so watch out generating a key check value with the same hash as used for the HMAC using that key. KCV's are stupid that way. Then again, there is absolutely no reason for keys with that size (nor for KCV's most of the time). $\endgroup$
    – Maarten Bodewes
    Aug 29 '16 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.