All Packages Class Hierarchy This Package Previous Next Index
java.lang.Object | +----java.security.MessageDigest | +----cryptix.provider.mac.HMAC
The definition of HMAC-X for a given message digest algorithm X depends
on that algorithm's internal block size, which is passed into the constructor
when this class is used directly. Normally, this class will be obtained
indirectly via the JCA API, e.g. MessageDigest.getInstance("HMAC-SHA-1")
if SHA-1 is to be used as the digest algorithm.
The key can be set as a byte array using the "key" parameter. It is not reset after the MAC has been returned (this enables successive MACs using the same key to be calculated efficiently). For example:
import java.security.Parameterized;
MessageDigest hmac = MessageDigest.getInstance("HMAC-SHA-1"); byte[] key = ..., input1 = ..., input2 = ...; ((Parameterized) mac).setParameter("key", key); byte[] mac1 = hmac.digest(input1); byte[] mac2 = hmac.digest(input2);
Parameters other than "key" are passed through to the MessageDigest object,
but this can only be done when the key is not set. An explicit call to
reset()
will 'unset' the key.
This implementation does not support truncation of the output MAC. If truncation is desired, the caller should use only the relevant initial bits of the output array.
Note that although this class implements Cloneable, its
clone()
method will throw a CloneNotSupportedException
if the underlying MessageDigest cannot be cloned. This should not be the
case for any of the Cryptix-supported digest algorithms.
References:
Copyright © 1997
Systemics Ltd on behalf of the
Cryptix Development Team.
All rights reserved.
$Revision: 1.2 $
public HMAC(String mdAlgorithm, int mdBlockSize)
Do not rely on being able to use this constructor to obtain a subclass of MessageDigest; when Cryptix is changed to use the Java 1.2 provider architecture, it will be a subclass of MessageDigestSpi instead.
public Object clone() throws CloneNotSupportedException
protected void engineReset()
protected void engineUpdate(byte input)
protected void engineUpdate(byte input[], int offset, int len)
protected byte[] engineDigest()
RFC 2104 describes HMAC as follows:
The definition of HMAC requires a cryptographic hash function, which we denote by H, and a secret key K. We assume H to be a cryptographic hash function where data is hashed by iterating a basic compression function on blocks of data. We denote by B the byte-length of such blocks (B=64 for all the above mentioned examples of hash functions), and by L the byte-length of hash outputs (L=16 for MD5, L=20 for SHA-1). The authentication key K can be of any length up to B, the block length of the hash function. Applications that use keys longer than B bytes will first hash the key using H and then use the resultant L byte string as the actual key to HMAC. In any case the minimal recommended length for K is L bytes (as the hash output length). See section 3 for more information on keys.
We define two fixed and different strings ipad and opad as follows (the 'i' and 'o' are mnemonics for inner and outer):
ipad = the byte 0x36 repeated B times
opad = the byte 0x5C repeated B times.
To compute HMAC over the data 'text' we perform
H(K XOR opad, H(K XOR ipad, text))
Namely,
protected int engineGetDigestLength()
public void setParameter(String param, Object value) throws InvalidParameterException
public Object getParameter(String param) throws InvalidParameterException
protected void engineSetParameter(String param, Object value) throws InvalidParameterException
protected Object engineGetParameter(String param) throws InvalidParameterException
All Packages Class Hierarchy This Package Previous Next Index