gen-define-an-hmac-and-give-one-short-worked-example-43e4

Define an HMAC and give one short worked example.

# HMAC (Hash-based Message Authentication Code) ## Definition HMAC is a cryptographic algorithm that combines a secret key with a message and a hash function to produce a message authentication code. It verifies both **data integrity** (message hasn't been altered) and **authenticity** (message came from someone who knows the secret key). **Formula:** HMAC(K, m) = H((K' ⊕ opad) || H((K' ⊕ ipad) || m)) Where: - K = secret key - m = message - H = hash function (like SHA-256) - opad = outer padding (0x5c repeated) - ipad = inner padding (0x36 repeated) ## Simple Worked Example Let's use a simplified version with actual HMAC-SHA256: **Inputs:** - Secret Key: `"secret"` - Message: `"Hello"` - Hash Function: SHA-256 **Process:** ``` HMAC-SHA256("secret", "Hello") ``` **Output:** ``` 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b ``` **Verification:** - Sender computes HMAC and sends: `"Hello" + HMAC value` - Receiver computes HMAC using same key and message - If receiver's HMAC matches sender's HMAC → **authentic and unmodified** ✓ - If different → **tampered or wrong sender** ✗ This ensures no one without the secret key can forge valid messages.