0

I've posted a related question on Stack Overflow, but I have a more general question about HMAC and SHA256.

Let's say I want to generate an HMAC hash for a blank key and a blank message. The Wikipedia page shows "b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad" as the example hash. However, if I take 64 of the opad 0x5c characters ("\") and append to it the SHA256 of 64 of the ipad 0x36 characters ("6"), then take the SHA256 of that whole string and I get "6c64aeadc27db5d98c91a8789d59c2ebed85c860072929b06b361fff434e00c2" as the answer.

Shouldn't this be the same as the answer to the blank HMAC? I think understanding the difference here is what's holding me back from getting my algorithm right.

Any help or guidance (even badmouthing at this point) would be much appreciated!

Improve this question

1 Answer 1

Reset to default
3

I've written simple python3 script to illustrate:

from hashlib import sha256
opad = bytes(0x5c for i in range(64))
ipad = bytes(0x36 for i in range(64))
print(sha256(opad + sha256(ipad).digest()).hexdigest())

The output is identical to the string you seen on wiki.

I've checked and I can confirm that your results can be obtained if we concatenate opad with hex-encoded hash of ipad. You should concatenate pure bytes there instead.

Improve this answer
3
  • Thank you! I think I see the error of my ways now. I'll spend an afternoon redoing my sha256 functions and if I get it right I'll mark your answer accepted
    – Sloan Reynolds
    Commented Aug 18, 2015 at 18:26
  • 1
    @SloanReynolds If you get it done please post what the root of your problem was, as it might help others in the future. Thanks.
    – bayo
    Commented Aug 18, 2015 at 18:44
  • @SloanReynolds If you are writing your own sha256 implementation you should validate it against some test vectors to verify that it is correct. Otherwise HMAC will obviously produce incorrect output. Test vectors can be found here.
    – puzzlepalace
    Commented Aug 19, 2015 at 10:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .