I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on the client (or the server? Does it matter which side?). At this point only one side has the secret. How does the secret get passed to on the other side (or if not passed once how does it ever come to know it)? Would this not involved sending it across albeit one time? How else would the secret ever be known to both the client and server? If sending it across during initialization is in fact the thing to do, how can this be done securely?
Now I realize that a separate channel might be used like email etc, but what if you needed to use establish HMAC automatically without user involvement?