HMAC-Konstruktionsdetails (RFC 2104)

Construction

HMAC computes a keyed hash by nesting the underlying hash function in two passes with the key padded to the block size. The inner hash applies the key XOR an inner pad constant to the message, and the outer hash applies the key XOR an outer pad constant to the inner result. This construction is provably secure as long as the underlying hash is a Merkle-Damgard pseudorandom function. The key is padded to the block size to ensure consistent processing.

inner pad

Key XOR 0x36 repeated to block size

ipad = 0x36

outer pad

Key XOR 0x5C repeated to block size

opad = 0x5C

key padding

Short keys zero-padded, long keys hashed first

K if len <= block

Key Length Guidance

The HMAC key should be at least as long as the hash output to achieve full security. Keys longer than the block size are first hashed down to the output size before padding. Random keys of output length are ideal, but longer keys do not harm security. Short keys reduce the effective security against key recovery. The key must be kept secret and generated from a cryptographically secure source.

Comparison Safety

Verifying an HMAC tag must use a constant-time comparison to prevent timing attacks that reveal the correct tag byte by byte. Standard equality operators often short-circuit on the first mismatched byte, leaking position information. Many libraries provide a constant-time compare function for this purpose. Failing to use constant-time comparison can completely undermine the authentication guarantee in networked services.