New answers tagged

3

There are two different notions of compliance here: Using a compliant algorithm — the official term is “Approved”. Hash algorithms for HMAC are Approved if they are listed in FIPS 180-4 (or earlier versions). SHA-1, SHA-256 and SHA-512 are all FIPS Approved secure hash algorithms and the HMAC function based on them are thus FIPS Approved HMAC functions. ...


6

"FIPS compliance" is about more than the algorithm. It is about implementations. Being awarded the "compliant" badge is a long, complex and very expensive process; its conceptual meaning is that there are some strong reasons to believe that the implementation is correct and secure and fulfils a number of security properties. Since we don't really know how to ...


2

Generally speaking, any combination of bytes you might send into hash_hmac in the $data parameter will be correctly processed by the function, so no sanitation is needed at that point in your script. However, you'll probably still need to do sanitation at some point in your script, but by checking the mac up front, you'll prevent all those wasted CPU cycles ...



Top 50 recent answers are included