I am preparing for a presentation and I need to understand how HMACSHA1 works. I understand what a salt is and I understand that it does a number of cycles but how does it really work?

When is the salt added?

Using just the standard .NET SHA1 hashing function how can I recreate a HMACSHA1 algorithm? I would like to do it manually, not with PBKDF2 implementation.

I was expecting the following 2 blocks of code to give the same output ... but they don't. Where did I went wrong ?

HMACSHA1 hmac = new HMACSHA1(System.Text.Encoding.Unicode.GetBytes("test"));
var x = hmac.ComputeHash(System.Text.Encoding.Unicode.GetBytes("test"));

SHA1 sha1 = new SHA1Managed();
var y = sha1.ComputeHash(System.Text.Encoding.Unicode.GetBytes("testtest"));
var yy = System.Text.Encoding.Unicode.GetBytes("test").ToString() + y;
var yyy = sha1.ComputeHash(System.Text.Encoding.Unicode.GetBytes(yy));
  • Wikipedia has decent explanations of both SHA-1 and HMAC – paj28 Sep 1 '16 at 12:54

You're confusing things. HMAC-SHA1 is a "Hash-based message authentication code" that uses SHA1 as hash. PBKDF2 is a key-derivation function. HMACs can be a primitive in the context of such a function but they aren't equivalent.

You CAN use a HMAC for creating salted hashes but you can as easily simply add the salt to the value directly before hashing and achieve the same thing. HMACs are more commonly used to validate the authenticity of messages.

For the .net question, I suggest you ask in stackoverflow but you might have a look at the HMACSHA1 class that is in the System.Security.Cryptography namespace.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.