I've posted a related question on Stack Overflow, but I have a more general question about HMAC and SHA256.

Let's say I want to generate an HMAC hash for a blank key and a blank message. The Wikipedia page shows "b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad" as the example hash. However, if I take 64 of the opad 0x5c characters ("\") and append to it the SHA256 of 64 of the ipad 0x36 characters ("6"), then take the SHA256 of that whole string and I get "6c64aeadc27db5d98c91a8789d59c2ebed85c860072929b06b361fff434e00c2" as the answer.

Shouldn't this be the same as the answer to the blank HMAC? I think understanding the difference here is what's holding me back from getting my algorithm right.

Any help or guidance (even badmouthing at this point) would be much appreciated!


I've written simple python3 script to illustrate:

from hashlib import sha256
opad = bytes(0x5c for i in range(64))
ipad = bytes(0x36 for i in range(64))
print(sha256(opad + sha256(ipad).digest()).hexdigest())

The output is identical to the string you seen on wiki.

I've checked and I can confirm that your results can be obtained if we concatenate opad with hex-encoded hash of ipad. You should concatenate pure bytes there instead.

  • Thank you! I think I see the error of my ways now. I'll spend an afternoon redoing my sha256 functions and if I get it right I'll mark your answer accepted – Sloan Reynolds Aug 18 '15 at 18:26
  • 1
    @SloanReynolds If you get it done please post what the root of your problem was, as it might help others in the future. Thanks. – bayo Aug 18 '15 at 18:44
  • @SloanReynolds If you are writing your own sha256 implementation you should validate it against some test vectors to verify that it is correct. Otherwise HMAC will obviously produce incorrect output. Test vectors can be found here. – puzzlepalace Aug 19 '15 at 10:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.