What is HMAC?

HMAC (Hash-based Message Authentication Code) is a mechanism for verifying the authenticity and integrity of a message using a hash function and a secret key.

It works as follows:

1. The message and secret key are processed through a hash function in a specific way.
2. The result is a unique hash code (HMAC).
3. This HMAC is sent along with the message.
4. The receiver, having the same message and secret key, recalculates the HMAC.
5. If the calculated HMAC matches the received one, it is considered that the message has not been altered and came from a source possessing the secret key.

HMAC_K(m) = Hash((K ⊕ opad) || Hash((K ⊕ ipad) || m))

Where:

• K — secret key.
• m — message.
• Hash — the hash function used (e.g., SHA-256).
• || — concatenation.
• ⊕ — XOR operation.
• ipad (inner pad) and opad (outer pad) — constants used in the algorithm.

The difference from a regular hash function is that HMAC uses a secret key, making it resistant to certain types of attacks aimed at forging the hash.

Applications in web development:

• Bearer tokens: For creating and verifying authentication tokens.
• Request signing: To verify the authenticity of API requests.
• Data verification: Ensuring that data has not been altered during transmission.

Advantages:

• High cryptographic strength.
• Compatible with various hash functions.
• Simple to implement.