Do I understand HMAC-SHA-xxx and HMAC-SHA-xxx-yyy correctly?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
2
down vote

favorite












I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly. Am I right about these three things?



  1. HMAC-SHA-xxx has an output length of xxx bits


  2. HMAC-SHA-xxx-yyy has an output length of yyy bits


  3. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bits of HMAC-SHA-xxx output.


If I am misunderstanding any of them, how so?






hmac







share|improve this question









New contributor




Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.























    up vote
    2
    down vote

    favorite












    I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly. Am I right about these three things?



    1. HMAC-SHA-xxx has an output length of xxx bits


    2. HMAC-SHA-xxx-yyy has an output length of yyy bits


    3. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bits of HMAC-SHA-xxx output.


    If I am misunderstanding any of them, how so?






    hmac







    share|improve this question









    New contributor




    Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
    Check out our Code of Conduct.





















      up vote
      2
      down vote

      favorite









      up vote
      2
      down vote

      favorite











      I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly. Am I right about these three things?



      1. HMAC-SHA-xxx has an output length of xxx bits


      2. HMAC-SHA-xxx-yyy has an output length of yyy bits


      3. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bits of HMAC-SHA-xxx output.


      If I am misunderstanding any of them, how so?






      hmac







      share|improve this question









      New contributor




      Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly. Am I right about these three things?



      1. HMAC-SHA-xxx has an output length of xxx bits


      2. HMAC-SHA-xxx-yyy has an output length of yyy bits


      3. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bits of HMAC-SHA-xxx output.


      If I am misunderstanding any of them, how so?






      hmac




      hmac






      share|improve this question









      New contributor




      Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      share|improve this question









      New contributor




      Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      share|improve this question




      share|improve this question








      edited 3 hours ago





















      New contributor




      Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      asked 6 hours ago









      Jan

      133




      133




      New contributor




      Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.





      New contributor





      Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.






      Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.




















          1 Answer
          1






          active

          oldest

          votes

















          up vote
          3
          down vote



          accepted











          1. HMAC-SHA-xxx has an output length of xxx bits



          That's right, the output of the HMAC function is identical to the output of the hash by default. This is obvious if you take the design of HMAC in consideration.




          1. HMAC-SHA-xxx-yyy has an output length of yyy bits



          Certainly. It has been defined that way in the venerable RFC 2104 - HMAC: Keyed-Hashing for Message Authentication, section 5: Truncated output.



          Not many implementations will allow you to specify the output size, so you may have to truncate yourself. Also note that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256).




          1. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bytes of HMAC-SHA-xxx output.



          Yes, you'd use the leftmost bits / bytes. yyy would be in bits, so you'd have to devide by 8 (and I would only allow multiples of 8 for yyy).



          Beware that the authors of the RFC talk about "recommend" and "propose" in section 5, so the implementation of HMAC-<hash>-yyy seems strictly optional.






          share|improve this answer


















          • 1




            What justifies "that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256)" ? I see no benefit compared to using full-width hash and truncating in the end, and never met that. Further, that would always reduce the amount of hashed data making it from the data hash of HMAC to the final hash; and, if the HMAC key is larger than 512-bit, that would get hashed to 224-bit rather than 256-bit as the key hash of HMAC, reducing the effective key size (admittedly, to a width that still seems large enough).
            – fgrieu
            1 hour ago











          Your Answer




          StackExchange.ifUsing("editor", function ()
          return StackExchange.using("mathjaxEditing", function ()
          StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix)
          StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
          );
          );
          , "mathjax-editing");

          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "281"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          convertImagesToLinks: false,
          noModals: false,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          noCode: true, onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );






          Jan is a new contributor. Be nice, and check out our Code of Conduct.









           

          draft saved


          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63251%2fdo-i-understand-hmac-sha-xxx-and-hmac-sha-xxx-yyy-correctly%23new-answer', 'question_page');

          );

          Post as a guest

















          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes








          up vote
          3
          down vote



          accepted











          1. HMAC-SHA-xxx has an output length of xxx bits



          That's right, the output of the HMAC function is identical to the output of the hash by default. This is obvious if you take the design of HMAC in consideration.




          1. HMAC-SHA-xxx-yyy has an output length of yyy bits



          Certainly. It has been defined that way in the venerable RFC 2104 - HMAC: Keyed-Hashing for Message Authentication, section 5: Truncated output.



          Not many implementations will allow you to specify the output size, so you may have to truncate yourself. Also note that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256).




          1. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bytes of HMAC-SHA-xxx output.



          Yes, you'd use the leftmost bits / bytes. yyy would be in bits, so you'd have to devide by 8 (and I would only allow multiples of 8 for yyy).



          Beware that the authors of the RFC talk about "recommend" and "propose" in section 5, so the implementation of HMAC-<hash>-yyy seems strictly optional.






          share|improve this answer


















          • 1




            What justifies "that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256)" ? I see no benefit compared to using full-width hash and truncating in the end, and never met that. Further, that would always reduce the amount of hashed data making it from the data hash of HMAC to the final hash; and, if the HMAC key is larger than 512-bit, that would get hashed to 224-bit rather than 256-bit as the key hash of HMAC, reducing the effective key size (admittedly, to a width that still seems large enough).
            – fgrieu
            1 hour ago















          up vote
          3
          down vote



          accepted











          1. HMAC-SHA-xxx has an output length of xxx bits



          That's right, the output of the HMAC function is identical to the output of the hash by default. This is obvious if you take the design of HMAC in consideration.




          1. HMAC-SHA-xxx-yyy has an output length of yyy bits



          Certainly. It has been defined that way in the venerable RFC 2104 - HMAC: Keyed-Hashing for Message Authentication, section 5: Truncated output.



          Not many implementations will allow you to specify the output size, so you may have to truncate yourself. Also note that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256).




          1. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bytes of HMAC-SHA-xxx output.



          Yes, you'd use the leftmost bits / bytes. yyy would be in bits, so you'd have to devide by 8 (and I would only allow multiples of 8 for yyy).



          Beware that the authors of the RFC talk about "recommend" and "propose" in section 5, so the implementation of HMAC-<hash>-yyy seems strictly optional.






          share|improve this answer


















          • 1




            What justifies "that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256)" ? I see no benefit compared to using full-width hash and truncating in the end, and never met that. Further, that would always reduce the amount of hashed data making it from the data hash of HMAC to the final hash; and, if the HMAC key is larger than 512-bit, that would get hashed to 224-bit rather than 256-bit as the key hash of HMAC, reducing the effective key size (admittedly, to a width that still seems large enough).
            – fgrieu
            1 hour ago













          up vote
          3
          down vote



          accepted







          up vote
          3
          down vote



          accepted







          1. HMAC-SHA-xxx has an output length of xxx bits



          That's right, the output of the HMAC function is identical to the output of the hash by default. This is obvious if you take the design of HMAC in consideration.




          1. HMAC-SHA-xxx-yyy has an output length of yyy bits



          Certainly. It has been defined that way in the venerable RFC 2104 - HMAC: Keyed-Hashing for Message Authentication, section 5: Truncated output.



          Not many implementations will allow you to specify the output size, so you may have to truncate yourself. Also note that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256).




          1. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bytes of HMAC-SHA-xxx output.



          Yes, you'd use the leftmost bits / bytes. yyy would be in bits, so you'd have to devide by 8 (and I would only allow multiples of 8 for yyy).



          Beware that the authors of the RFC talk about "recommend" and "propose" in section 5, so the implementation of HMAC-<hash>-yyy seems strictly optional.






          share|improve this answer















          1. HMAC-SHA-xxx has an output length of xxx bits



          That's right, the output of the HMAC function is identical to the output of the hash by default. This is obvious if you take the design of HMAC in consideration.




          1. HMAC-SHA-xxx-yyy has an output length of yyy bits



          Certainly. It has been defined that way in the venerable RFC 2104 - HMAC: Keyed-Hashing for Message Authentication, section 5: Truncated output.



          Not many implementations will allow you to specify the output size, so you may have to truncate yourself. Also note that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256).




          1. If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bytes of HMAC-SHA-xxx output.



          Yes, you'd use the leftmost bits / bytes. yyy would be in bits, so you'd have to devide by 8 (and I would only allow multiples of 8 for yyy).



          Beware that the authors of the RFC talk about "recommend" and "propose" in section 5, so the implementation of HMAC-<hash>-yyy seems strictly optional.







          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited 5 hours ago

























          answered 6 hours ago









          Maarten Bodewes

          49.7k569182




          49.7k569182







          • 1




            What justifies "that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256)" ? I see no benefit compared to using full-width hash and truncating in the end, and never met that. Further, that would always reduce the amount of hashed data making it from the data hash of HMAC to the final hash; and, if the HMAC key is larger than 512-bit, that would get hashed to 224-bit rather than 256-bit as the key hash of HMAC, reducing the effective key size (admittedly, to a width that still seems large enough).
            – fgrieu
            1 hour ago













          • 1




            What justifies "that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256)" ? I see no benefit compared to using full-width hash and truncating in the end, and never met that. Further, that would always reduce the amount of hashed data making it from the data hash of HMAC to the final hash; and, if the HMAC key is larger than 512-bit, that would get hashed to 224-bit rather than 256-bit as the key hash of HMAC, reducing the effective key size (admittedly, to a width that still seems large enough).
            – fgrieu
            1 hour ago








          1




          1




          What justifies "that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256)" ? I see no benefit compared to using full-width hash and truncating in the end, and never met that. Further, that would always reduce the amount of hashed data making it from the data hash of HMAC to the final hash; and, if the HMAC key is larger than 512-bit, that would get hashed to 224-bit rather than 256-bit as the key hash of HMAC, reducing the effective key size (admittedly, to a width that still seems large enough).
          – fgrieu
          1 hour ago





          What justifies "that using a standardized, truncated version of SHA-2 should be preferred (e.g. SHA-224 is already a truncated version of SHA-256)" ? I see no benefit compared to using full-width hash and truncating in the end, and never met that. Further, that would always reduce the amount of hashed data making it from the data hash of HMAC to the final hash; and, if the HMAC key is larger than 512-bit, that would get hashed to 224-bit rather than 256-bit as the key hash of HMAC, reducing the effective key size (admittedly, to a width that still seems large enough).
          – fgrieu
          1 hour ago











          Jan is a new contributor. Be nice, and check out our Code of Conduct.









           

          draft saved


          draft discarded


















          Jan is a new contributor. Be nice, and check out our Code of Conduct.












          Jan is a new contributor. Be nice, and check out our Code of Conduct.











          Jan is a new contributor. Be nice, and check out our Code of Conduct.













           


          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63251%2fdo-i-understand-hmac-sha-xxx-and-hmac-sha-xxx-yyy-correctly%23new-answer', 'question_page');

          );

          Post as a guest
































































          Comments

          Post a Comment

          Popular posts from this blog

          What does second last employer means? [closed]

          Image
          Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote -3 down vote favorite Say, for example I have worked in the following companies, Company A => 2010 - 2011 Company B => 2011 - 2012 Company C => 2012 - Till Date Company D => Have offer Now assume Company D is asking to submit documents from my second last employer. So from the list of companies given, which company would be qualified as second last employer? software-industry employer share | improve this question asked Aug 10 '14 at 5:16 Rajaprabhu Aravindasamy 559 1 6 13 closed as off-topic by Jim G., jmort253 ♦ Aug 11 '14 at 1:58 This question appears to be off-topic. The users who voted to close gave this specific reason: "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address...
          Read more

          Installing NextGIS Connect into QGIS 3?

          Image
          Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote 1 down vote favorite Just acquired free version of NEXTGIS and trying to install the plugin for QGIS. It tells me it was not designed for version 3 of QGIS. How do I set up the QGIS-NEXTGIS interface then? qgis qgis-plugins nextgis share | improve this question edited 3 hours ago PolyGeo ♦ 51.9k 17 77 233 asked 4 hours ago IanGS 16 4 New contributor IanGS is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. add a comment  |  up vote 1 down vote favorite Just acquired free version of NEXTGIS and trying to install the plugin for QGIS. It tells me it was not designed for version 3 of QGIS. How do I set up the QGIS-NEXTGIS interface then? qgis qgis-plugin...
          Read more

          One-line joke

          A one-liner is a joke that is delivered in a single line. A good one-liner is said to be pithy - concise and meaningful. [1] Comedians and actors use this comedic method as part of their act, e.g. Jimmy Carr, Tommy Cooper, Rodney Dangerfield, Norm Macdonald, Ken Dodd, Stewart Francis, Zach Galifianakis, Mitch Hedberg, Anthony Jeselnik, Milton Jones, Shappi Khorsandi, Jay London, Mark Linn-Baker, Demetri Martin, Groucho Marx, Dan Mintz, Emo Philips, Tim Vine, Steven Wright and Henny Youngman and Arnold Schwarzenegger. [ citation needed ] Many fictional characters are also known to deliver one-liners, including James Bond, who usually includes pithy and laconic quips after disposing of a villain. [ citation needed ] Examples "A baby seal walks into a club." "A dyslexic man walks into a bra." (Anonymous) "There are three types of people, those who can count and those who can't." "Venison's dear, isn't it?" (Jimmy Carr) "An escala...
          Read more