HMAC实现 - 伪代码

Question

我需要在一个嵌入式项目中实现自己的HMAC-SHA256。但是我遇到了一些问题，甚至无法让伪代码手算出结果，所以我知道我做错了什么！

我的伪代码计算。按照维基百科上的图示进行操作。

 1 function hmac (key, message)
 2     if (length(key) > blocksize) then
 3         // keys longer than blocksize are shortened
 4         key = hash(key)
 5     end if
 6     if (length(key) < blocksize) then
 7         // keys shorter than blocksize are zero-padded
 8         key = key ∥ zeroes(blocksize - length(key))
 9     end if
10
11     // Where blocksize is that of the underlying hash function
12     o_key_pad = [0x5c * blocksize] ⊕ key
13     i_key_pad = [0x36 * blocksize] ⊕ key // Where ⊕ is exclusive or (XOR)
14     // Where ∥ is concatenation
15     return hash(o_key_pad ∥ hash(i_key_pad ∥ message))
16 end function

当我手动计算key="mykey"和message="helloworld"时，得到以下结果：

key = 0x6d796b6579000000000000000000000000000000000000000000000000000000

o_key_pad = 0x31253739255c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c

i_key_pad = 0x5b4f5d534f363636363636363636363636363636363636363636363636363636

hash(i_key_pad ∥ message) = 6fb2e91de7b8b5ec6283846ff7245cd6eb4a4fd26056b529bd42d99fcf3314d2

整个hmac的值为0d76a16089f85cd2169bb64b6f2c818e6a404a218896483fcd97fee5cce185ae。

- Reid

Answer 1

当固定密钥长度并计算内部和外部填充时，您需要使用底层哈希函数的块大小（blocksize），它与其输出大小不同。这是函数操作的输入块的大小。对于SHA256，块大小为512位（64字节）和输出大小为256位（32字节）。

如果将块大小设置为32，则得到的结果就是32。

使用正确长度的块大小，key、o_key_pad和i_key_pad基本相同，只是长度是两倍，并在末尾分别有00、5c或36个字节。

内部哈希的结果即为(hash(i_key_pad ∥ message))。

8bf029764919f9e35249d0d55ffb8fd6c62fe23a85c1515e0120c5005aa813d5

最终值(hash(o_key_pad ∥ hash(i_key_pad ∥ message)))是：

7fdfaa9c9c0931f52d9ebf2538bc99700f2e771f3af1c1d93945c2256c11aedd

这与OpenSSL的HMAC实现所得到的结果相匹配。

- matt

Answer 2

这是我想出来的代码：

 /**
 * This function takes in a key, the length of that key, a message (null terminated) and a pointer to a char[32] or greater array
 * It calculates the HMAC-SHA256 of the given key message combo and returns the resulting code in binary form, 32 hex pairs
1 @example ???? todo function hmac (key, message)
2     if (length(key) > blocksize) then
3         // keys longer than blocksize are shortened
4         key = hash(key)
5     end if
6     if (length(key) < blocksize) then
7         // keys shorter than blocksize are zero-padded
8         key = key ∥ zeroes(blocksize - length(key))
9     end if
10
11     // Where blocksize is that of the underlying hash function
12     o_key_pad = [0x5c * blocksize] ⊕ key
13     i_key_pad = [0x36 * blocksize] ⊕ key // Where ⊕ is exclusive or (XOR)
14     // Where ∥ is concatenation
15     return hash(o_key_pad ∥ hash(i_key_pad ∥ message))
16 end function
 * @param key todo
 * @param length todo
 * @param message todo
 * @param hmac todo
*/
void hmac(char key[], int length, char message[], char *hmac){
    int msgLen = strlen(message);   //get the length of the message to be encrypted
    char keyFinal[BLOCK_SIZE] = {0}; //setup array for the data to go into

    if(length > BLOCK_SIZE){         //if the given data is too long, hash it
        shaHash(key, keyFinal);
    }
    if(length < BLOCK_SIZE){         //if the given data is too short, pad it with 0x00
        int i;
        for(i = 0; i < BLOCK_SIZE; i++){
            if(i < length){             //read in the data
                keyFinal[i] = key[i];
            }else{                      //if there is no more data to read, read in zeros
                keyFinal[i] = 0x00;
            }
        }
    }
    if(length == BLOCK_SIZE){        //if the given data is the right size, transfer it to keyFinal
        int i;
        for(i = 0; i < BLOCK_SIZE; i++){
            keyFinal[i] = key[i];
        }
    }

    char oKeyPad[BLOCK_SIZE] = {0};    //setup the oKeyPad
    char iKeyPad[BLOCK_SIZE] = {0};    //setup the ikeypad

    int i;
    for(i = 0; i < BLOCK_SIZE; i++){ //for each item in key final, xor it with O_KEY_PAD and I_KEY_PAD
        oKeyPad[i] = keyFinal[i] ^ O_KEY_PAD;
        iKeyPad[i] = keyFinal[i] ^ I_KEY_PAD;
    }

    char iandmesg[BLOCK_SIZE+MAX_SHA];   //setup the inner hash ikeypad concat with message
    char hash_iandmesg[HASH_LEN] = {0};       //get ready to get bytes back from the hashing function

    //make the message to be hashed, ikeypad concatinated with message
    for(i = 0; i < BLOCK_SIZE; i++){ //read in ikeypad
        iandmesg[i] = iKeyPad[i];
    }
    for(i = BLOCK_SIZE; i < (msgLen + BLOCK_SIZE); i++){ //read in message
        iandmesg[i] = message[i-BLOCK_SIZE];
    }

    shaHash_len(iandmesg, (msgLen+BLOCK_SIZE), hash_iandmesg);   //create the inner hash (ikeypad + message)

    char oandihash[(BLOCK_SIZE + HASH_LEN)];    //setup the outter hash, okeypad + (hash of ikeypad + message)

    //make the message to be hashed, okeypad concatinated with the hash of (ikeypad + message)
    for(i = 0; i < BLOCK_SIZE; i++){ //read in okeypad
        oandihash[i] = oKeyPad[i];
    }
    for(i = BLOCK_SIZE; i < (BLOCK_SIZE + HASH_LEN); i++){ //read in hash of ikeypad + message
        oandihash[i] = hash_iandmesg[i-BLOCK_SIZE];
    }

    //return the result of the hash of (okeypad + hash(ikeypad + message))
    shaHash_len(oandihash, (BLOCK_SIZE + HASH_LEN), hmac);
}

- Reid