TL;DR
Hash-based message authentication code (HMAC) is a dual-layer cryptographic technique that combines a secret key with a hash function to verify data integrity and authenticity. It is especially valuable for organizations handling sensitive data — such as payment information or regulated records — because intercepted messages are rendered unreadable without the correct key. Developers can implement HMAC using a shared secret and a chosen hashing algorithm, and should test thoroughly before deployment to avoid blocking legitimate users.
What is HMAC?
Hash-based message authentication code (or HMAC) is a cryptographic authentication technique that uses a hash function and a secret key.
With HMAC, you can achieve authentication and verify that data is correct and authentic with shared secrets, as opposed to approaches that use signatures and asymmetric cryptography.
How does HMAC work?
Two parties want to communicate, but they want to ensure that the contents of their connection remain private. They also distrust the internet, and they need a way to verify that the packets they receive haven't been tampered with. HMAC is a valid solution.
| Component | Type | Description |
|---|---|---|
| Cryptographic keys | Secret key | An encryption algorithm alters data, and a recipient needs a specific code (or key) to make it readable once more. HMAC relies on a shared set of secret keys. |
| Hash function | Algorithm | A hash algorithm alters or digests the message once more. HMAC uses generic cryptographic hash functions, such as SHA-1 (Secure Hash Algorithm 1), MD5, or RIPEMD-128/60. Both parties must pick one hash function that all of their messages will move through. |
| Secret keys (agreement) | Shared secret | Both parties must have a way to decode messages they get. A secret key handles this task, and it's meant to stay secret and hidden. |
When complete, the message is considered irreversible, and it's also resistant to hacking. Someone who intercepts this message won't even be able to guess at its length. The work renders the message contents absolutely useless to anyone without a key or a code.
HMAC tester tools can help demonstrate how something like this works. Imagine you're dealing with these inputs:
- Potential message: I would like to buy 100 units.
- Secret key: 666
- Algorithm: MD5
The resulting message reads: " fd9f18089206e67b163771a3883185ab."
What does HMAC look like mathematically?
A dense layer of mathematics underlies what seems like an easy translation process. When we attempt to display what HMAC looks like mathematically, we use diagrams like this.
Understanding the math is critical for developers. If you're asked to explain your work and the protections you offer, a diagram can often showcase things better than your words ever can.
But the average computer user may never need to understand the math. To them, knowing that their messages are protected may be all they require.
How do you implement HMAC?
To use HMAC, either as an individual or a web developer, you'll need two important things. And you'll need an agreement about those items with your recipients, so you're all using the same tools at the same time.
These are the two items you'll need:
- A shared secret
- A hashing tool
Only your server should know all the items for all of your users. And that data should be fiercely protected. Anyone who knows the secret keys for your members can take over your server and/or send fraudulent data.
Every website and coding environment is different, but walking through an example might be helpful. Imagine that you'd like to use HMAC on traffic that comes to your website via dynamic ads from Google. You will:
- Build your token in Ad Manager. You'll specify details about the visit and the time. You'll use Google's authentication key to create your "secret key."
- Implement. You can put your new token within your authorization request header, or you can pass it as a query string or form data parameter.
Google makes this process quick and easy. Developers can access a simple tutorial and copy code within minutes.
Notice that you're not asking your Google Ads visitors to memorize a code or do any decoding. The user's server understands the coding requirements within your website, and all of the token setting and translation is invisible to the user.
Why testing your HMAC implementation matters
Even so, you should test this environment often before you deploy it. If you encounter a coding error, you could block people from accessing your site, as it will seem as though they're fraudulent actors. It pays to test any system like this on multiple devices before you set it loose on the wider world.
When should you use HMAC?
Nearly every company has sensitive information. If you take in payments of any sort, for example, you likely have credit card data at your fingertips. And if you have employees, you have Social Security numbers that could be stolen.
Which industries benefit most from HMAC?
But some companies have even deeper issues. If you're in a heavily regulated environment, such as health care, or you deal with trade secrets, such as munitions, it pays to move past traditional security measures.
HMAC, with its dual levels of protection, could be ideal for companies that need to do a little more to prove that they're protecting their assets as carefully as possible.
Help From Okta
At Okta, we believe in customized security solutions to help our clients thrive. Learn how Okta uses HMAC signature algorithms to keep your organization secure.
Frequently asked questions
What is HMAC and how is it different from other authentication methods?
HMAC (Hash-based message authentication code) combines a cryptographic hash function with a secret key to verify both the authenticity and integrity of a message. Unlike approaches that rely on asymmetric cryptography and digital signatures, HMAC uses shared secret keys, making it a symmetric authentication technique.
What two components does HMAC require to function?
HMAC relies on two core components: a cryptographic key (a shared secret that both parties use to encode and decode messages) and a hash function (an algorithm such as SHA-1, MD5, or RIPEMD-128/160 that transforms the message into an irreversible digest).
How secure is a message protected by HMAC?
Once processed, an HMAC-protected message is considered irreversible and resistant to tampering. An interceptor cannot determine the original message or even its length without possessing the correct secret key.
What do both parties need to agree on before using HMAC?
Both communicating parties must agree on two things in advance: the shared secret key used to encode and decode messages, and the specific hash algorithm that all messages will be processed through.
What are the risks of improperly securing HMAC secret keys?
If the secret keys are exposed, an attacker could take over the server or inject fraudulent data. Only the server should have access to all users' secret keys, and that data must be rigorously protected.
Why is testing an HMAC implementation important before deployment?
A misconfigured HMAC setup can cause legitimate users to be incorrectly flagged as fraudulent actors and blocked from accessing the site. Thorough testing across multiple devices before going live helps prevent these access issues.
References
HMAC: Keyed-Hashing for Message Authentication. (February 1997). Network Working Group.
HMAC and Key Derivation. Practical Cryptography for Developers.
HMAC Generator/Tester Tool. FreeFormatter.
How API Request Signing Works (And How to Implement HMAC in NodeJS). (2016). Andrew Hoang.
Implement HMAC Authentication (Beta). Google Ad Manager Help.
How to Implement HMAC
To use HMAC, either as an individual or a web developer, you'll need two important things. And you'll need an agreement about those items with your recipients, so you're all using the same tools at the same time.
These are the two items you'll need:
- A shared secret
- A hashing tool
Only your server should know all the items for all of your users. And that data should be fiercely protected. Anyone who knows the secret keys for your members can take over your server and/or send fraudulent data.
Every website and coding environment is different, but walking through an example might be helpful. Imagine that you'd like to use HMAC on traffic that comes to your website via dynamic ads from Google. You will:
- Build your token in Ad Manager. You'll specify details about the visit and the time. You'll use Google's authentication key to create your "secret key."
- Implement. You can put your new token within your authorization request header, or you can pass it as a query string or form data parameter.
Google makes this process quick and easy. Developers can access a simple tutorial and copy code within minutes.
Notice that you're not asking your Google Ads visitors to memorize a code or do any decoding. The user's server understands the coding requirements within your website, and all of the token setting and translation is invisible to the user.
Even so, you should test this environment often before you deploy it. If you encounter a coding error, you could block people from accessing your site, as it will seem as though they're fraudulent actors. It pays to test any system like this on multiple devices before you set it loose on the wider world.
When Should You Use HMAC?
Nearly every company has sensitive information. If you take in payments of any sort, for example, you likely have credit card data at your fingertips. And if you have employees, you have Social Security numbers that could be stolen.
But some companies have even deeper issues. If you're in a heavily regulated environment, such as health care, or you deal with trade secrets, such as munitions, it pays to move past traditional security measures.
HMAC, with its dual levels of protection, could be ideal for companies that need to do a little more to prove that they're protecting their assets as carefully as possible.
Help From Okta
At Okta, we believe in customized security solutions to help our clients thrive. Learn how Okta uses HMAC signature algorithms to keep your organization secure.
References
HMAC: Keyed-Hashing for Message Authentication. (February 1997). Network Working Group.
HMAC and Key Derivation. Practical Cryptography for Developers.
HMAC Generator/Tester Tool. FreeFormatter.
How API Request Signing Works (And How to Implement HMAC in NodeJS). (2016). Andrew Hoang.
Implement HMAC Authentication (Beta). Google Ad Manager Help.
