# Generating HMAC-SHA256 - is this procedure secure enough?

I have 256-bit value (call it "{Secret Value}") and I would like to compute HMAC-SHA256 digest of this value to check its integrity, and second requirement is to minimize need of another artifacts for this process.

I have an idea that do not need any other artifact but {Secret Value}:

1. Compute PBKDF2 key from {Secret Value}, and as a salt use first 64 bits of my {Secret Value}
2. Key computed in step 1 use as key for HMAC-SHA256 and as value use {Secret Value}

Another option in step 1 is compute another PBKDF2 key for salt value from {Secret Value}.

I need to create this integrity digest to check if {Security Value} comming from user is the same as value I have in database.

Is this approach secure enough?

If you do this like that you won't guarantee the authenticity of your message, only its integrity, as you say you want to... but then if you only need to check integrity, you would be fine with a simpler SHA256.

But FWIW, HMAC is like a wrapper around a secure hash function adding a key, so if you remove the key, you end up with a secure hash function, plus some sequin, if I dare say so.

So, I wouldn't say it is secure per se, unless I knew what problem you are trying to solve, but this way to go will provide you with integrity while using a somewhat more complicated method than usual. (Which is generally not recommended.)