LAB 9 REPORT

Course name: Cryptography and Applications

Course code: CRY302
Class: IA1162
Student name Student ID
Pham Nguyen Khoa SE62320

Part 1: Review HMAC

1. Review MAC, HMAC.

A MAC can be created from a hash function; the message and the key are

concatenated in various ways. A very simple way is

𝑀 = 𝐻(𝑘 ∨ 𝐻(𝑘 ∨ 𝑚)).

In other words, given the message and the key, the MAC can be created by

these steps:

1. Concatenate the key with the message.

2. Hash the result.
3. Place the key in front of the hash value.
4. Hash again.

A more powerful scheme is called HMAC. It can be used with any hash function.
+ ⊕ 𝑜𝑝𝑎𝑑
+ ⊕ 𝑖𝑝𝑎𝑑
𝐾 ∨ 𝐻[ ]

𝐻𝑀𝐴𝐶(𝐾, 𝑀) = 𝐻
2. With HMAC, the text string is broken-up into blocks of a fixed size, and then are
iterated over with a compression function. Typically, such as for MD5 and SHA-1,
these blocks are 512 bytes each. With MD5 the output is 128 bits and for SHA-1 it is
160 bits, which is the same as the standard hash functions. HMAC is used in many
applications, such as in IPSec and in tunneling sockets (TLS). An outline of its
operation is:

Part 2: Describe in your words: Implementation of HMAC

HMAC (keyed-hash message authentication code or hash-based message
authentication code) is a specific type of message authentication code (MAC)
involving a cryptographic hash function and a secret cryptographic key.
Implementation of HMAC:
Part 3:

Use the tool of Bill Buchanan’s page http://billatnapier.com/security01.aspx

to check the following examples:

Example 1. Let the message and the key as in the first two rows of the table. Use a
tool to verify the HMACs.

Me 123456789ABCDEF123456789ABCDEF
ssa
ge
Ke 100100100100100100100100100100100
y
MD 308E525F41004C0D234CCA4338F110A8
5
SH F9B9CBEA25D48283A935797A7731EB2EE7821D28
A-1
SH 881FD2E6D0993F840D29758301F77C54942FF7177CE3EFC07C39803201A5
A2 429E
56
SH D53D4CE689096F4AA1C847D6FB0580B37EFA1D7BE04C14509A20BD9C
A- 749C955AF576CDA870E2FFDA8E25E4AC7E72E1AF
384
SH C66086615AEB6CC9F8844BF6F9F5E5D3335CFB51D955F18EBE80746AE3
A- 9275444FCF56664E72258A0BA9010A97E669F77523A27FC23C7F95B624C
512 9690E5F2146

4. Example 2. Let the message and the key as in the first two rows of the table. Use a
tool to verify the HMACs.

Me 5B5A57676A56676E
ssa
ge
Ke 675A69675E5A6B5A
y
M 3439829972CD17A5FC7FC3638C388314
D5
SH 0D7EF6468F45259ED3212B65AB84D82099D2DA39
A-1
SH 433CCE414E071F2B7111BDEC7114A4DF567D86A6E2E635BC4FDAF9F08
A2 FEFB760
56
SH E16D4E5487C831453B90936257485304692F08F5886AC102D24A18935DD
A- D06189FD83326D25577A8580B8B8FFC36CF7A
384
SH 26FFA003C789E417032BBF7EA2AC18A80D0E3B74ED4A6A8ECCDF09C9
A- E995BDE54463D54DBF80D0FA1E0594D323172B1A573CCAD15CAA132F
512 A3069CD964651490

5. Example 3. Let the message and the key as in the first two rows of the table. Use a
tool to verify the HMACs.

Me testtoday
ssa
ge
Ke hellokitty
y
M 8EF0FDD15328D632FE6F1D22EA666519
D5
SH 52F3637FE1375C1EAC8079CDCADCCF32E13A08F7
A-1
SH 6796457A09C92D703D2128F55EB88F81DE7A5D8B9C7D763268AFF3118B
A2 C4CB54
56
SH 04AE606F08C4DF7135CBD94B1B8F8A420B7D67EEF415364A08A2CAB49
A- BF322F449C0A36D421A2C433AC063F81F52716B
384
SH 593B2E7A84994EDEFF1351FA63A83B8E4136086706DABD768C05A487FC
A- EFC0BB4A592221BC745C9D74574DE807D9162FAFD0E3CC3A7F112BC13
512 1474158F53F02