5
$\begingroup$

I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly. Am I right about these three things?

  1. HMAC-SHA-xxx has an output length of xxx bits

  2. HMAC-SHA-xxx-yyy has an output length of yyy bits

  3. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bits of HMAC-SHA-xxx output.

If I am misunderstanding any of them, how so?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
6
$\begingroup$
  1. HMAC-SHA-xxx has an output length of xxx bits

That's right, the output of the HMAC function is identical to the output of the hash by default. This is obvious if you take the design of HMAC in consideration.

  1. HMAC-SHA-xxx-yyy has an output length of yyy bits

Certainly. It has been defined that way in the venerable RFC 2104 - HMAC: Keyed-Hashing for Message Authentication, section 5: Truncated output.

Not many implementations will allow you to specify the output size, so you may have to truncate yourself. Beware that it is best to perform a time-constant compare when verifying a HMAC value if you have to perform the truncation instead.

Using a standardized, truncated version of SHA-2 would be an option if truncation of the hash is not available (e.g. SHA-224 is already a truncated version of SHA-256). It has the disadvantage that the inner security of the hash is lowered together with the output size.

  1. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bytes of HMAC-SHA-xxx output.

Yes, you'd use the leftmost bits / bytes. yyy would be in bits, so you'd have to devide by 8 (and I would only allow multiples of 8 for yyy).

Beware that the authors of the RFC talk about "recommend" and "propose" in section 5, so the implementation of HMAC-<hash>-yyy seems strictly optional.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Not quite; SHA-224 is truncation of a hash that uses the same input blocking and padding as SHA-256, and same compression function, but different initial state. Thus its security is the same as truncating SHA-256, but its actual value for given input is different. And similarly for SHA-384 vs SHA-512, and SHA-512-slash-(224,256,other) vs SHA-512. $\endgroup$
    – dave_thompson_085
    Oct 20, 2018 at 4:31
  • $\begingroup$ True, but as the size of the internal hash is different, the starting state of the outer hash will be different anyway, and HMAC-SHA-224 will be different from HMAC-SHA-256 even if the constants were the same. And the key should be shorter as well, if you use the HMAC recommendations. $\endgroup$
    – Maarten Bodewes ♦
    Oct 20, 2018 at 5:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.