HMAC算法

前言：
【1】“message authentication codes” (MAC)
【2】“hash-based message authentication codes” (HMAC)
【3】https://www.packetizer.com/rfc/rfc2104/

HMAC: Keyed-Hashing for Message Authentication

Status of This Memo

This memo provides information for the Internet community. This memo
does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.

Abstract

This document describes HMAC, a mechanism for message authentication
using cryptographic hash functions. HMAC can be used with any
iterative cryptographic hash function, e.g., MD5, SHA-1, in
combination with a secret shared key. The cryptographic strength of
HMAC depends on the properties of the underlying hash function.

1. Introduction

   Providing a way to check the integrity of information transmitted
   over or stored in an unreliable medium is a prime necessity in the
   world of open computing and communications. Mechanisms that provide
   such integrity check based on a secret key are usually called
   “message authentication codes” (MAC). Typically, message
   authentication codes are used between two parties that share a secret
   key in order to validate information transmitted between these
   parties. In this document we present such a MAC mechanism based on
   cryptographic hash functions. This mechanism, called HMAC, is based
   on work by the authors [BCK1] where the construction is presented and
   cryptographically analyzed. We refer to that work for the details on
   the rationale and security analysis of HMAC, and its comparison to
   other keyed-hash methods.

Krawczyk, et. al. Informational [Page 1]

RFC 2104 HMAC February 1997

HMAC can be used in combination with any iterated cryptographic hash
function. MD5 and SHA-1 are examples of such hash functions. HMAC
also uses a secret key for calculation and verification of the
message authentication values. The main goals behind this
construction are

• To use, without modifications, available hash functions.
  In particular, hash functions that perform well in software,
  and for which code is freely and widely available.

• To preserve the original performance of the hash function without
  incurring a significant degradation.

• To use and handle keys in a simple way.

• To have a well understood cryptographic analysis of the strength of
  the authentication mechanism based on reasonable assumptions on the
  underlying hash function.

• To allow for easy replaceability of the underlying hash function in
  case that faster or more secure hash functions are found or
  required.

This document specifies HMAC using a generic cryptographic hash
function (denoted by H). Specific instantiations of HMAC need to
define a particular hash function. Current candidates for such hash
functions include SHA-1 [SHA], MD5 [MD5], RIPEMD-128/160 [RIPEMD].
These different realizations of HMAC will be denoted by HMAC-SHA1,
HMAC-MD5, HMAC-RIPEMD, etc.

Note: To the date of writing of this document MD5 and SHA-1 are the
most widely used cryptographic hash functions. MD5 has been recently
shown to be vulnerable to collision search attacks [Dobb]. This
attack and other currently known weaknesses of MD5 do not compromise
the use of MD5 within HMAC as specified in this document (see
[Dobb]); however, SHA-1 appears to be a cryptographically stronger
function. To this date, MD5 can be considered for use in HMAC for
applications where the superior performance of MD5 is critical. In
any case, implementers and users need to be aware of possible
cryptanalytic developments regarding any of these cryptographic hash
functions, and the eventual need to replace the underlying hash
function. (See section 6 for more information on the security of
HMAC.)

Krawczyk, et. al. Informational [Page 2]

RFC 2104 HMAC February 1997

2. Definition of HMAC

   The definition of HMAC requires a cryptographic hash function, which