HMAC
HMAC is a keyed message authentication code constructed from a cryptographic hash function and a secret key to authenticate data and verify its integrity.
Software Security for Developers
HMAC is a keyed message authentication construction that combines a secret key with a cryptographic hash function to provide message integrity and authenticity.
- How it is used
- Protects files, request payloads, API calls, and protocol messages against tampering while authenticating parties sharing a secret.
- How deep it goes
- Defines the construction and implementation choices, but deliberately defers the internal key-mixing algorithm and its mathematics.
- Examples
- Uses an ACME refunds.json transfer, Java Mac code, validation logic, and comparisons with plain hashes and RSA signatures.
- What you can do after
- Apply it via Java's Mac and SecretKeySpec APIs to compute and validate HMAC-SHA-256 values before processing data.
Hacking Cryptography
HMAC is a keyed-hash message authentication construction that produces an integrity and authentication tag from a key and message.
- How it is used
- Authenticates messages and detects modification when a shared secret must protect an API request or protocol message.
- How deep it goes
- Explains the nested equation, key normalization, ipad/opad transformations, and attacks against simpler MACs.
- Examples
- Uses a forged bank transaction, Flickr-style API authentication, RADIUS, AWS API signatures, and HMAC-MD5 as concrete cases.
- What you can do after
- Evaluate MAC designs and choose HMAC instead of direct secret-prefix or secret-suffix hashing for authentication.
Secure APIs
HMAC is a message authentication code construction that combines a hash function with a secret key to authenticate data.
- How it is used
- Authenticates API requests and JWTs by combining a shared secret with a hash-derived digest or signature.
- How deep it goes
- Defines shared-key request authentication and JWT signing inputs, but does not descend into HMAC internals or implementation code.
- Examples
- Uses an HS256 JWT whose signature covers the base64url-encoded header and payload joined by a dot.
- What you can do after
- Evaluate/understand how HMAC authenticates API requests and signs JWTs without encrypting their claims.
Real-World Cryptography
HMAC is a standardized keyed-hash message authentication code constructed from a cryptographic hash function and a secret key.
- How it is used
- Protects message integrity and authenticity when communicating parties share a secret key.
- How deep it goes
- Explains keyed tag generation, verification, replay limits, length-extension risks, and constant-time comparison without detailing HMAC internals.
- Examples
- Demonstrates Rust sender and receiver functions using HMAC-SHA-256, message tags, and verification.
- What you can do after
- Apply it via Rust to authenticate messages, verify tags safely, and avoid direct SHA-256 MAC constructions.
Related concepts
- message authentication codekind of · A message authentication code is a keyed cryptographic value generated from a message to verify its integrity and authenticity.
- hash functionuses · A hash function deterministically maps input data to a value in a bounded output range, commonly for indexing, lookup, comparison, or integrity checking.
- SHA-256uses · SHA-256 is a standardized cryptographic hash function in the SHA-2 family that maps arbitrary input data to a fixed-length 256-bit digest.
- HKDFused by · HKDF is a key derivation function that derives cryptographic keying material from input keying material using HMAC.
- JSON Web Signaturecontrasts with · JSON Web Signature is a JOSE standard for representing digitally signed or message-authentication-code-protected content in JSON-based form.
- cryptographic hashuses · A cryptographic hash is a fixed-length digest computed from input data by a deterministic function designed to resist preimage, second-preimage, and collision attacks.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.