Skip to content

HMAC, and comparing in constant time

Level: 201 · working knowledge

Stub — an outline, not a lesson. There is no runnable example behind this page yet, so nothing on it has been through the check that backs every other claim in this library. The bullets below are the questions the finished page has to answer.

One line: A keyed tag, and the comparison that must not return early.

The questions this page has to answer

  • Why is sha256(secret || message) not a MAC? (Length extension, and a demonstration of it.)
  • What does HMAC's nested construction fix, and why the two pads?
  • Why does == on a tag leak the tag, one byte at a time, over enough requests?
  • hmac.compare_digest in Python, and what 'constant time' can and cannot promise in a garbage-collected language.
  • Encrypt-then-MAC vs MAC-then-encrypt: which orderings have been broken, and in what setting.

See also