I need to verify a MAC for something signed with HMAC-SHA512/256, however, the language I'm using (Salesforce's Apex language) doesn't have support for that algorithm. It does have HMAC-SHA512 and HMAC-SHA256 though – is there a way to transform one into the other, or somehow emulate the truncated version via other arithmetic/string operations?

  • Hash functions are the building blocks for HMAC functions. See RFC2104 for more information. en.wikipedia.org/wiki/HMAC is also informative. You may be able to build your own HMAC-SHA512 or HMAC-SHA256 functions in Salesforce scripting using SHA512 or SHA256 respectively, using the algorithms referenced above.
    – mti2935
    Jul 20, 2021 at 15:27
  • Sorry, I wasn't clear there - it does have HMAC-SHA512 and HMAC-SHA256, but not HMAC-SHA512/256.
    – Synchro
    Jul 20, 2021 at 15:31
  • Thanks for clarifying and editing your question accordingly. Does Salesforce scripting have the SHA-512/256 hash function? If so, you might be able to use this to build a HMAC-SHA-512/256 HMAC function. If not, it's going to be a challenge to implement SHA-512/256. SHA-512/256 is more than just sha512 truncated to 256 bits - it uses a different method to generate the initialization values, among other things.
    – mti2935
    Jul 20, 2021 at 17:21
  • No, SF doesn't have it as a hash function either. This is mostly what I feared...
    – Synchro
    Jul 20, 2021 at 17:23

2 Answers 2


There is no way to transform either SHA-512 or SHA-256 into SHA-512/256. SHA-512/256 is based off SHA-512, but uses a different initial value and is truncated. In order to successfully use SHA-512 to create a SHA-512/256, you'd have to be able to invert the hash function, change the IV, and then recompute the new hash value. Unfortunately for you, cryptographic hash functions are designed to be computationally infeasible to invert.

SHA-256 shares a similar structure with the other SHA-2 functions you've mentioned, but it works on 32-bit values instead of 64-bit values and has a few other parameter changes, so it's also not possible as an option. The fact that HMAC is involved definitely doesn't make anything easier here, either.

In your particular case, you may wish to write some sort of plugin for your Salesforce environment that calls out to a suitable crypto library which can provide the functionality you want. Recent versions of OpenSSL and Nettle both support SHA-512/256 and HMAC.

  • Thanks for summarizing what I suspected! At the signing end HMAC-SHA512/256 was chosen because it's faster than HMAC-SHA256 and smaller than HMAC-SHA512. It also has very wide language support, and is even the default MAC in the well-respected libsodium. Unfortunately Salesforce Apex doesn't support it, so I'm stuck.
    – Synchro
    Jul 21, 2021 at 8:52

I'm not familiar with Salesfoce, but I heard that it has a PHP SDK.

PHP 7.1 does support SHA-512/256, and it can be used in hash_hmac and related functions.

Side notes:

SHA512/256 is a strange choice for instantiating HMAC - while SHA512/256 is secure against length-extension attack, HMAC is secure against it as well; even when performance advantage on 64-bit platforms considered, SHA256 has better interoperability. So maybe the source that produces HMAC-SHA512/256 can be changed.

The Apex API Doc strangely states that

Invalid algorithm algoName. Must be AES128, AES192, AES256, AES384, or AES512.

There is no such thing as AES384 or AES512, and it brings the validity of its claims to question.

Next, the API generateDigest supports SHA3-384, but not SHA-384, so I'd suspect that the listing of algorithm may be incomplete. You may bet on the chance of it happen to provide SHA-512/256.

  • No, Salesforce is not written in PHP, and the language that it supports is not PHP but their own language called "Apex", and it does not support the HMAC-SHA512/256 algorithm.
    – Synchro
    Jul 21, 2021 at 8:49
  • @Synchro Sorry about the factual error. But it does seem have a PHP SDK. Not sure if this is a viable solution.
    – DannyNiu
    Jul 21, 2021 at 8:56
  • Their SDK is for talking to the Salesforce API from the outside. This case is about their Apex language that runs on the inside of their environment. It might be feasible to "shell out" to some external service that can calculate a MAC (Apex supports arbitrary HTTP requests), but that would add an awful lot of overhead for something so small!
    – Synchro
    Jul 21, 2021 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.