In cryptography, a keyed-hash message authentication code (HMAC) is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret cryptographic key.
As with any MAC, it may be used to simultaneously verify both the data integrity and the authentication of a message.
Any cryptographic hash function, such as MD5 or SHA-1, may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA1 accordingly.
The cryptographic strength of the HMAC depends upon the cryptographic strength of the underlying hash function, the size of its hash output, and on the size and quality of the key.
An iterative hash function breaks up a message into blocks of a fixed size and iterates over them with a compression function.
For example, MD5 and SHA-1 operate on 512-bit blocks. The size of the output of HMAC is the same as that of the underlying hash function (128 or 160 bits in the case of MD5 or SHA-1, respectively), although it can be truncated if desired.
HMAC-SHA1 and HMAC-MD5 are used within the IPsec and TLS protocols.
Signature generating algorithm on Client and Server side
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Base64;
import org.apache.log4j.Logger;
import com.francetelecom.csrtool.model.logging.FuncLogging;
import com.francetelecom.csrtool.utils.CSRToolUtil;
/**
* Utility class to generate HMAC message digest based on key and (SHA256/SHA512) algorithm
*/
public class HMACGenerator {
/** HMAC256 **/
public static final String HMAC256 = "HmacSHA256";
/** HMAC512 **/
public static final String HMAC512 = "HmacSHA512";
/** LOGGER Constant */
private static final Logger LOGGER = Logger.getLogger(HMACGenerator.class);
/**
* Generates a encrypted message digest based on HMACSHA256 or HMACSHA512 algorithm on the data and specific key
* @param base64Key - base64 private key
* @param data refers to the data need to be encrypted
* @param algorithm refers to the message digest algorithm been used (256 -> HMACSHA256) and (512 -> HMACSHA512)
* @return HMAC encrypted String
*/
public static String generateHMACUsingBase64Key(String base64Key, String data) {
if(Util.isStringNullOrEmpty(base64Key) || Util.isStringNullOrEmpty(data)) {
return null;
}
// Decode Base64 key (string) to bytes
byte[] secretkeyByte = Base64.decodeBase64(base64Key.getBytes());
// Generate secret key specific to algorithm
SecretKeySpec signingKey = new SecretKeySpec(secretkeyByte, HMAC256);
String base64Digest = null;
byte[] dataBytes = data.getBytes();
try {
// Load and initialize algorithm using signing key
Mac mac = Mac.getInstance(HMAC256);
mac.init(signingKey);
// Generate the HMAC using input data bytes
byte[] rawHmac = mac.doFinal(dataBytes);
// Convert raw HMAC into Base64 HMAC
byte[] hash = Base64.encodeBase64(rawHmac);
base64Digest = new String(hash);
} catch (NoSuchAlgorithmException e) {
} catch (InvalidKeyException e) {
}
return base64Digest;
}
}
