I'm using an HMAC as a way to generate a deterministic challenge token for an authentication system.
I've effectively got three string inputs plus a key:
- Client IP address (string, eg: "127.0.0.1")
- Client nonce (string, eg: "2325363F")
- Linux epoch (string, eg: "594077C6")
My key is 256 bit (32 bytes) array.
How should I be performing the HMAC, is it really just a simple case of using string concatenation?
I'm fairly confident the above is just as secure as a hash tree or doing multiple HMAC operations, but would like to confirm my suspicions.