HMAC Algorithm in Computer Network

HMAC (Hash-based Message Authentication Code) is a type of message authentication code (MAC) that is acquired by executing a cryptographic hash function on the data that is to be authenticated and a secret shared key. Like any of the MACs, it is used for both data integrity and authentication. In this article, we will discuss every point about HMAC.

What is HMAC?

HMAC algorithm stands for Hashed or Hash-based Message Authentication Code. It is a result of work done on developing a MAC derived from cryptographic hash functions. HMAC is a great resistance to cryptanalysis attacks as it uses the Hashing concept twice. HMAC consists of twin benefits of Hashing and MAC and thus is more secure than any other authentication code. RFC 2104 has issued HMAC, and HMAC has been made compulsory to implement in IP security. The FIPS 198 NIST standard has also been issued by HMAC. 

Objectives of HMAC

• As the Hash Function, HMAC is also aimed to be one way, i.e., easy to generate output from input but complex the other way around. 
• It aims at being less affected by collisions than the hash functions. 
• HMAC reuses algorithms like MD5 and SHA-1 and checks to replace the embedded hash functions with more secure hash functions, in case found. 
• HMAC tries to handle the Keys in a more simple manner. 

Working of HMAC Algorithm

The working of HMAC starts with taking a message M containing blocks of length b bits. An input signature is padded to the left of the message and the whole is given as input to a hash function which gives us a temporary message-digest MD'. MD' again is appended to an output signature and the whole is applied a hash function again, the result is our final message digest MD. Here is a simple structure of HMAC: 

• Here, H stands for Hashing function, 
• M is the original message 
• Si and So are input and output signatures respectively, 
• Yi is the ith block in original message M, where I ranges from [1, L) 
• L = the count of blocks in M 
• K is the secret key used for hashing 
• IV is an initial vector (some constant) 
• The generation of input signature and output signature Si and So respectively. 

To a normal hash function, HMAC adds a compression instance to the processing. This structural implementation holds efficiency for shorter MAC values.

Security in Hash-based Message Authentication Code 

HMAC is more secure than MAC since the key and message are hashed in different steps:

HMAC(key, message) = H(mod1(key) || H(mod2(key) || message).

The data is initially hashed by the client using a private key before being sent to the server as part of the request. The server then creates its own HMAC. This assures that the process is not vulnerable to attacks, which could result in crucial data being disclosed as subsequent MACs are generated. Additionally, once the procedure is completed, the delivered message becomes irreversible and resistant to hackers. Even if a malicious party attempts to steal the communication, they will be unable to determine its length or decrypt it because they do not have the decryption key.

Advantages of HMAC

• HMACs are ideal for high-performance systems like routers due to the use of hash functions which are calculated and verified quickly unlike the public key systems.
• Digital signatures are larger than HMACs, yet the HMACs provide comparably higher security.
• HMACs are used in administrations where public key systems are prohibited.

Disadvantages of HMAC

• HMACs uses shared key which may lead to non-repudiation. If either sender or receiver’s key is compromised then it will be easy for attackers to create unauthorized messages.
• Securely managing and distributing secret keys can be challenging.
• Although unlikely, hash collisions (where two different messages produce the same hash) can occur.
• The security of HMAC depends on the length of the secret key. Short keys are more vulnerable to brute-force attacks.
• The security of HMAC relies on the strength of the chosen hash function (e.g., SHA-256). If the hash function is compromised, HMAC is also affected.

Applications of HMAC

• Verification of e-mail address during activation or creation of an account.
• Authentication of form data that is sent to the client browser and then submitted back.
• HMACs can be used for Internet of things (IoT) due to less cost.
• Whenever there is a need to reset the password, a link that can be used once is sent without adding a server state.
• It can take a message of any length and convert it into a fixed-length message digest. That is even if you got a long message, the message digest will be small and thus permits maximizing bandwidth.

Conclusion

HMAC (Hash-Based Message Authentication Code) is a cryptographic technique that ensures data integrity and authenticity using a hash function and a secret key. It is widely used in secure communication protocols like HTTPS and SFTP. HMAC provides higher security than traditional MACs due to its two-step hashing process, making it resistant to certain types of attacks. Despite challenges like key management and potential hash collisions, HMAC remains a robust and efficient method for securing data in various applications, including email verification, IoT, and password reset mechanisms.