Editing HMAC (section)

== Details ==
Any cryptographic hash function, such as [[SHA-2]] or [[SHA-3]], may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-''x'', where ''x'' is the hash function used (e.g. HMAC-SHA256 or HMAC-SHA3-512). The [[cryptographic strength]] of the HMAC depends upon the cryptographic strength of the underlying hash function, the size of its hash output, and the size and quality of the key.<ref name="BCK96" />

HMAC uses two passes of hash computation. Before either pass, the secret key is used to derive two keys – inner and outer. Next, the first pass of the hash algorithm produces an internal hash derived from the message and the inner key. The second pass produces the final HMAC code derived from the inner hash result and the outer key. Thus the algorithm provides better immunity against [[length extension attack]]s.

An iterative hash function (one that uses the [[Merkle–Damgård construction]]) breaks up a message into blocks of a fixed size and iterates over them with a [[one-way compression function|compression function]]. For example, SHA-256 operates on 512-bit blocks. The size of the output of HMAC is the same as that of the underlying hash function (e.g., 256 and 512 bits in the case of SHA-256 and SHA3-512, respectively), although it can be truncated if desired.

HMAC does not encrypt the message. Instead, the message (encrypted or not) must be sent alongside the HMAC hash. Parties with the secret key will hash the message again themselves, and if it is authentic, the received and computed hashes will match.

The definition and analysis of the HMAC construction was first published in 1996 in a paper by [[Mihir Bellare]], [[Ran Canetti]], and [[Hugo Krawczyk]],<ref name=BCK96/><ref name=":1">{{Cite journal |last1=Bellare |first1=Mihir |last2=Canetti |first2=Ran |last3=Krawczyk |first3=Hugo |date=Spring 1996 |title=Message Authentication using Hash Functions—The HMAC Construction |url=https://cseweb.ucsd.edu/~mihir/papers/hmac-cb.pdf |journal=CryptoBytes |volume=2 |issue=1}}</ref> and they also wrote RFC 2104 in 1997.{{Ref RFC|2104|rsection=2}} The 1996 paper also defined a nested variant called NMAC (Nested MAC). [[Federal Information Processing Standards|FIPS]] PUB 198 generalizes and standardizes the use of HMACs.<ref>{{Cite journal |date=16 July 2008 |title=FIPS 198-1: The Keyed-Hash Message Authentication Code (HMAC) |url=https://csrc.nist.gov/publications/detail/fips/198/1/final |journal=Federal Information Processing Standards}}</ref> HMAC is used within the [[IPsec]],<ref name=":1" /> [[Secure Shell|SSH]] and [[Transport Layer Security|TLS]] protocols and for [[JSON Web Token]]s.