Cryptology Academy · Lesson

HMAC Construction & Security Proof

Walk through the ipad/opad construction and its security properties.

Lesson 2 of 413 steps

HMAC Construction & Security Proof is a free Cryptology Academy lesson on CoddyKit. This is lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

HMAC is the standard keyed MAC construction. Its double-hash design prevents length-extension attacks and has a formal security proof reducing HMAC security to the underlying hash function.

HMAC Construction

HMAC(K, M) = H((K' ⊕ opad) || H((K' ⊕ ipad) || M)) Where: - K' = K zero-padded to block size B (or H(K) if |K|>B) - ipad = 0x36 repeated B times - opad = 0x5C repeated B times

Why ipad and opad?

ipad (0x36) and opad (0x5C) are different constants ensuring K' ⊕ ipad ≠ K' ⊕ opad. They effectively create two different pseudorandom keys from K, used for inner and outer hashing.

HMAC Step by Step

For K=secret, M=message, H=SHA256: 1. K' = K padded to 64 bytes 2. inner_key = K' XOR ipad 3. inner_hash = SHA256(inner_key || M) 4. outer_key = K' XOR opad 5. result = SHA256(outer_key || inner_hash)

HMAC in Python

import hmac, hashlib key = b'my_secret_key' message = b'Hello, World!' mac = hmac.new(key, message, hashlib.sha256) print(mac.hexdigest()) # 64-char hex string (256 bits)

Why Length Extension Fails on HMAC

Given HMAC(K,M) = SHA256(outer_key || SHA256(inner_key || M)) Attacker knows SHA256(inner_key || M) = inner_hash. But they cannot extend it — the outer hash takes (outer_key || inner_hash) as input, not just inner_hash. They don't know outer_key.

HMAC Security Proof (Bellare)

Bellare (1996) proved: if the hash function H is a pseudorandom function (PRF), then HMAC is a PRF. In practice: HMAC-SHA256 is as secure as SHA-256 for its intended security properties.

Key Length for HMAC

HMAC key must be: - At least L bytes (hash output length) - Recommended: exactly L bytes of random data - If key > block_size: key is pre-hashed to block_size - Use os.urandom(32) for HMAC-SHA256 keys

HMAC Truncation

HMAC output can be truncated to half the output length without significant security loss. TOTP/HOTP truncate to 4 bytes. TLS MACs truncate. Never truncate below 80 bits (10 bytes).

HMAC in Different Contexts

HMAC-SHA256 uses: - TOTP: authentication codes (truncated to 6 digits) - TLS 1.2: session MACs (not needed in TLS 1.3 with AEAD) - JWTs: HS256 signing (symmetric) - API request signing: GitHub webhooks, AWS SigV4

HKDF: HMAC-based Key Derivation

HKDF(IKM, salt, info, L) uses HMAC twice: 1. Extract: PRK = HMAC-SHA256(salt, IKM) 2. Expand: OKM = HMAC-SHA256(PRK, info || counter) Used in TLS 1.3 key schedule, Signal, WireGuard for key derivation.

Quick Check

What is the purpose of opad (0x5C repeated) in HMAC?

Answer it in the interactive lesson

Recap

HMAC construction and proof understood. Next we apply HMAC to API request signing and see how to prevent replay attacks.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “HMAC Construction & Security Proof” lesson free?

Yes — the full text of “HMAC Construction & Security Proof” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “HMAC Construction & Security Proof”?

Walk through the ipad/opad construction and its security properties. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 2 of 4.

How long does the “HMAC Construction & Security Proof” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy