HMAC

1. HMAC (Hash based Message Authentication Code)

HMAC (Hash based Message Authentication Code) is a technique that guarantees the integrity of Data through Hashing techniques. [Figure 1] shows the HMAC process. Both the sender and receiver of the Message have the same MAC algorithm and Secret Key. Here, the MAC Algorithm refers to a Hashing function, and generally the SHA-256 algorithm is widely used. The Secret Key is used as the Key for Hashing.

The sender generates a MAC using the MAC Algorithm and Secret Key, and then transmits the MAC together with the original Message. The receiver generates a MAC using the received Message with the same MAC Algorithm and Secret Key as the sender, and verifies the integrity of the Message by comparing it with the received MAC.

1.1. with Rest API

HMAC is also utilized in Rest API for the integrity guarantee and authentication process of Messages. The MAC value is generally included in the Header value of HTTP or GRPC and transmitted together from the sender to the receiver. There is no standard yet for the Header that contains HMAC, and each API specifies and uses it separately.

For example, in the case of AWS API, the Signature (MAC) value is generated by utilizing the Secret Access Key together with the string generated from the Message through the SHA-256 algorithm, and the generated Signature is included in the X-Amz-Signature Header and transmitted.

2. References

• HMAC : https://m.blog.naver.com/techtrip/221723355441
• HMAC : https://velog.io/@stop7089/HMAC-%EC%9D%B4%EB%9E%80
• HMAC : https://haneepark.github.io/2018/04/22/hmac-authentication/
• HMAC : https://stackoverflow.com/questions/22683952/security-issue-hmac-in-header-vs-https-or-both
• AWS Authentication : https://docs.aws.amazon.com/ko_kr/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
• Azure Authentication : https://learn.microsoft.com/ko-kr/azure/azure-app-configuration/rest-api-authentication-hmac