Key-based Hashing
Key-based Hashing
One of the great things about teaching is when you get probing questions from questions that allow you to explain things in different ways. And, so, yesterday, one student asked if an encryption key could be used with a hash. And, of course, it does, but I had used the term “HMAC”, and had not actually given it, its correct generic name of a key-based hash. So, let’s have a look at key-based hashing.
With our normal hashing, we data any amount of input data, and then correct it (normally) into a fixed-length hash:
And so, if Bob and Alice are communicating, how do they know that it is them that are still part of the communication and that Eve hasn’t hi-jacked their session? Well, this is where key-based hashing comes in. With this Bob and Alice can authenticate each other at the start of the conversation, and then generate a shared secret. This secret might be a long-term secret that they used in every conversation they have, or could be generated for every conversation they have. Hopefully, Eve will not know this secret, and even if she discovers it, Bob and Alice can move to another secret.
HMAC (Hash-based Message Authentication Code) can be used to verify the integrity and authentication of a message. It involves hashing the message with a secret key and thus differs from standard hashing, which is purely a one-way function. The great strength of HMAC, is that it can be used with many existing hashing methods, and where Bob and Alice would agree on their preferred hashing method. For standardization, they may use SHA-256, but for speed, they could select Blake2b.
The figure below outlines the operation, where the message to be sent is converted with a secret key, and the hashing function, to an HMAC code. This is then sent with the message. On receipt, the receiver recalculates the HMAC code from the same secret key, and the message, and checks it against the received version. If they match, it validates both the sender and the message.
So let’s do some Python. The following takes a message, and a key, and generates a range of HMAC outputs [here]:
from cryptography.hazmat.primitives import hashes, hmac
import binascii
import sys
st = "The quick brown fox jumps over the lazy dog"
hex=False
showhex="No"
k="key"
def show_hmac(name,type,data,key):
digest = hmac.HMAC(key, type)
digest.update(data)
res=digest.finalize()
hex=binascii.b2a_hex(res).decode()
b64=binascii.b2a_base64(res).decode()
print (f"HMAC-{name}: {hex} {b64}")
if (len(sys.argv)>1):
st=str(sys.argv[1])
if (len(sys.argv)>2):
showhex=str(sys.argv[2])
if (len(sys.argv)>3):
k=str(sys.argv[3])
if (showhex=="yes"): hex=True
try:
if (hex==True): data = binascii.a2b_hex(st)
else: data=st.encode()
if (hex==True): key = binascii.a2b_hex(k)
else: key=k.encode()
print ("Data: ",st)
print (" Hex: ",binascii.b2a_hex(data).decode())
print ("Key: ",k)
print (" Hex: ",binascii.b2a_hex(key).decode())
print()
show_hmac("Blake2p (64 bytes)",hashes.BLAKE2b(64),data,key)
show_hmac("Blake2s (32 bytes)",hashes.BLAKE2s(32),data,key)
show_hmac("MD5",hashes.MD5(),data,key)
show_hmac("SHA1",hashes.SHA1(),data,key)
show_hmac("SHA224",hashes.SHA224(),data,key)
show_hmac("SHA256",hashes.SHA256(),data,key)
show_hmac("SHA384",hashes.SHA384(),data,key)
show_hmac("SHA3_224",hashes.SHA3_224(),data,key)
show_hmac("SHA3_256",hashes.SHA3_256(),data,key)
show_hmac("SHA3_384",hashes.SHA3_384(),data,key)
show_hmac("SHA3_512",hashes.SHA3_512(),data,key)
show_hmac("SHA512",hashes.SHA512(),data,key)
show_hmac("SHA512_224",hashes.SHA512_224(),data,key)
show_hmac("SHA512_256",hashes.SHA512_256(),data,key)
except Exception as e:
print(e)
A sample run gives [here]:
Data: The quick brown fox jumps over the lazy dog
Hex: 54686520717569636b2062726f776e20666f78206a756d7073206f76657220746865206c617a7920646f67
Key: key
Hex: 6b6579
HMAC-Blake2p (64 bytes): 92294f92c0dfb9b00ec9ae8bd94d7e7d8a036b885a499f149dfe2fd2199394aaaf6b8894a1730cccb2cd050f9bcf5062a38b51b0dab33207f8ef35ae2c9df51b kilPksDfubAOya6L2U1+fYoDa4haSZ8Unf4v0hmTlKqva4iUoXMMzLLNBQ+bz1Bio4tRsNqzMgf47zWuLJ31Gw==
HMAC-Blake2s (32 bytes): f93215bb90d4af4c3061cd932fb169fb8bb8a91d0b4022baea1271e1323cd9a0 +TIVu5DUr0wwYc2TL7Fp+4u4qR0LQCK66hJx4TI82aA=
HMAC-MD5: 80070713463e7749b90c2dc24911e275 gAcHE0Y+d0m5DC3CSRHidQ==
HMAC-SHA1: de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9 3nybhbi3iqa8ino29wqQcBydtNk=
HMAC-SHA224: 88ff8b54675d39b8f72322e65ff945c52d96379988ada25639747e69 iP+LVGddObj3IyLmX/lFxS2WN5mIraJWOXR+aQ==
HMAC-SHA256: f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg=
HMAC-SHA384: d7f4727e2c0b39ae0f1e40cc96f60242d5b7801841cea6fc592c5d3e1ae50700582a96cf35e1e554995fe4e03381c237 1/RyfiwLOa4PHkDMlvYCQtW3gBhBzqb8WSxdPhrlBwBYKpbPNeHlVJlf5OAzgcI3
HMAC-SHA3_224: ff6fa8447ce10fb1efdccfe62caf8b640fe46c4fb1007912bf85100f /2+oRHzhD7Hv3M/mLK+LZA/kbE+xAHkSv4UQDw==
HMAC-SHA3_256: 8c6e0683409427f8931711b10ca92a506eb1fafa48fadd66d76126f47ac2c333 jG4Gg0CUJ/iTFxGxDKkqUG6x+vpI+t1m12Em9HrCwzM=
HMAC-SHA3_384: aa739ad9fcdf9be4a04f06680ade7a1bd1e01a0af64accb04366234cf9f6934a0f8589772f857681fcde8acc256091a2 qnOa2fzfm+SgTwZoCt56G9HgGgr2SsywQ2YjTPn2k0oPhYl3L4V2gfzeiswlYJGi
HMAC-SHA3_512: 237a35049c40b3ef5ddd960b3dc893d8284953b9a4756611b1b61bffcf53edd979f93547db714b06ef0a692062c609b70208ab8d4a280ceee40ed8100f293063 I3o1BJxAs+9d3ZYLPciT2ChJU7mkdWYRsbYb/89T7dl5+TVH23FLBu8KaSBixgm3AgirjUooDO7kDtgQDykwYw==
HMAC-SHA512: b42af09057bac1e2d41708e48a902e09b5ff7f12ab428a4fe86653c73dd248fb82f948a549f7b791a5b41915ee4d1ec3935357e4e2317250d0372afa2ebeeb3a tCrwkFe6weLUFwjkipAuCbX/fxKrQopP6GZTxz3SSPuC+UilSfe3kaW0GRXuTR7Dk1NX5OIxclDQNyr6Lr7rOg==
HMAC-SHA512_224: a1afb4f708cb63570639195121785ada3dc615989cc3c73f38e306a3 oa+09wjLY1cGORlRIXha2j3GFZicw8c/OOMGow==
HMAC-SHA512_256: 7fb65e03577da9151a1016e9c2e514d4d48842857f13927f348588173dca6d89 f7ZeA1d9qRUaEBbpwuUU1NSIQoV/E5J/NIWIFz3KbYk=
Conclusions
And, so we have a message that allows us to not only provide integrity for data, we can also prove identity. If you are interested, I have included a range of MACs here: