HMAC is a message authentication code (MAC) that uses a cryptographic hash function and secret key to authenticate messages and verify their integrity. It was standardized in 1995 and is commonly used to provide security for browser communications, network protocols, REST APIs, wireless technologies, and more. HMAC works by hashing the key concatenated with the hashed key and message. It provides authentication and integrity but not confidentiality.

1. HMAC a signature
alternative
Montpellier 9 / 1 /2018

2. Agenda
About me
Introduction
History
Usages
Principles
Code sample…

3. About the speaker
Open standards, Java, JS,
Agility and infoSec
passionate since lthe last
century…
@hgregoire
CTO @ Agysoft

4. Introduction
• CIA Security principles
Confidentiality
Integrity Availability

5. HMAC, What’s for ?
• Wikipedia : In cryptography, a keyed-hash message authentication code
(HMAC) is a specific type of message authentication code (MAC) involving a
cryptographic hash function and a secret cryptographic key.
Features:
• Authentification of message
• Integrity of message
• NOT Confidentiality
Source: https://en.wikipedia.org/wiki/Message_authentication_code

6. HMAC History
• RFC 2104 , in 1995 experts from IBM and l’USCD
• Many attacks based on key length, hash function , and brute force
• Initialy: MAC = H(key || message) , vulnerable to length attack
• then: MAC = H(message || key), vulnerable to collisions
• then: MAC = H(key || message || key) better, but still cracked
• Many variants called VMAC, NMAC that are rarely used
• FIPS PUB 198 generalizes and standardizes the use of HMACs.
• RFC 6151, in 2011 MD5 vulnerability proof but prefer SHA3

7. HMAC principles (2011 version)
• H(key || H(key || message))
• Key is XOR’ed
Source: http://www.unixwiz.net/techtips/iguide-ipsec.html

8. HMAC Usages
•Almost everywhere…
•Brower : TLS
•Network : VPN
•Rest service : Token JWS
•Wireless : WPA,
Bluetooth

9. HMAC Code sample
• Java implementation since jdk5, better use Apache
Commons Codec
• JSON Web Signature (JWS) with HMAC protection
https://connect2id.com/products/nimbus-jose-jwt/examples/jws-with-hmac
• Here's a sample in NodeJS using the NodeJS crypto
library:
var hmac = crypto.createHmac('sha256', secret_key);
hmac.update(request.body.message);
var signature = hmac.digest('hex'));
SecretKeySpec signingKey = new
SecretKeySpec(key.getBytes(), HMAC_SHA1_ALGORITHM);
final Mac mac = Mac.getInstance(HMAC_SHA1_ALGORITHM);
mac.init(signingKey);
mac.doFinal(message.getBytes());

10. HMAC in your Browser
• W3C Javascript API WebCrypto implements HMAC,
use Polyfill or crypto.js library for older browsers
LIVE DEMO: https://jameshfisher.com/2017/10/31/web-cryptography-api-hmac.html

11. Merci à vous !
Rejoignez nous ! Agysoft recrute 1 dev et 1 archi