Network Working Group P. Cheng Request for Comments: 2202 IBM Category: Informational R. Glenn NIST September 1997
This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
This document provides two sets of test cases for HMAC-MD5 and HMAC-
SHA-1, respectively. HMAC-MD5 and HMAC-SHA-1 are two constructs of
the HMAC [HMAC] message authentication function using the MD5 [MD5]
hash function and the SHA-1 [SHA] hash function. Both constructs are
used by IPSEC [OG,CG] and other protocols to authenticate messages.
The test cases and results provided in this document are meant to be
used as a conformance test for HMAC-MD5 and HMAC-SHA-1
implementations.
The general method for constructing a HMAC message authentication function using a particular hash function is described in section 2 of [HMAC]. We will not repeat the description here. Section 5 of [HMAC] also discusses truncating the output of HMAC; the rule is that we should keep the more significant bits (the bits in the left, assuming a network byte order (big-endian)).
In sections 2 and 3 we provide test cases for HMAC-MD5 and HMAC-SHA- 1, respectively. Each case includes the key, the data, and the result. The values of keys and data are either hexadecimal numbers (prefixed by "0x") or ASCII character strings in double quotes. If a value is an ASCII character string, then the HMAC computation for the corresponding test case DOES NOT include the trailing null character ('\0') in the string.
The C source code of the functions used to generate HMAC-SHA-1 results is listed in the Appendix. Note that these functions are meant to be simple and easy to understand; they are not optimized in any way. The C source code for computing HMAC-MD5 can be found in [MD5]; or you can do a simple modification to HMAC-SHA-1 code to get HMAC-MD5 code, as explained in the Appendix.
The test cases in this document are cross-verified by three independent implementations, one from NIST and two from IBM Research. One IBM implementation uses optimized code that is very different from the code in the Appendix. An implemenation that concurs with the results provided in this document should be interoperable with other similar implemenations. We do not claim that such an implementation is absolutely correct with respect to the HMAC definition in [HMAC].
This docuemnt raises no security issues. Discussion on the strength of the HMAC construction can be found in [HMAC].
[HMAC] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997. [MD5] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992. [SHA] NIST, FIPS PUB 180-1: Secure Hash Standard, April 1995. [OG] Oehler, M., and R. Glenn, "HMAC-MD5 IP Authentication with Replay Prevention", RFC 2085, February 1997. [CG] Chang, S., and R. Glenn, "HMAC-SHA IP Authentication with Replay Prevention", Work in Progress.
Pau-Chen Cheng
IBM T.J. Watson Research Center
EMail: pau@watson.ibm.com
Robert Glenn
NIST
Building 820, Room 455
Gaithersburg, MD 20899
EMail: rob.glenn@nist.gov
This appendix contains the C reference code which implements HMAC- SHA-1 using an existing SHA-1 library. It assumes that the SHA-1 library has similar API's as those of the MD5 code described in RFC 1321. The code for HMAC-MD5 is similar, just replace the strings "SHA" and "sha" with "MD5" and "md5". HMAC-MD5 code is also listed in RFC 2104.
#ifndef SHA_DIGESTSIZE
#define SHA_DIGESTSIZE 20
#endif
#ifndef SHA_BLOCKSIZE
#define SHA_BLOCKSIZE 64 #endif
#ifndef MD5_DIGESTSIZE
#define MD5_DIGESTSIZE 16
#endif
#ifndef MD5_BLOCKSIZE
#define MD5_BLOCKSIZE 64 #endif /* Function to print the digest */ void pr_sha(FILE* fp, char* s, int t) { int i ;
fprintf(fp, "0x") ;
for (i = 0 ; i < t ; i++)
fprintf(fp, "%02x", s[i]) ;
fprintf(fp, "0) ;
}
void truncate
(
char* d1, /* data to be truncated */ char* d2, /* truncated data */ int len /* length in bytes to keep */ ) { int i ; for (i = 0 ; i < len ; i++) d2[i] = d1[i]; }
/* Function to compute the digest */ void hmac_sha ( char* k, /* secret key */ int lk, /* length of the key in bytes */ char* d, /* data */ int ld, /* length of data in bytes */ char* out, /* output buffer, at least "t" bytes */ int t ) { SHA_CTX ictx, octx ; char isha[SHA_DIGESTSIZE], osha[SHA_DIGESTSIZE] ; char key[SHA_DIGESTSIZE] ; char buf[SHA_BLOCKSIZE] ; int i ;
if (lk > SHA_BLOCKSIZE) {
SHA_CTX tctx ;
SHAInit(&tctx) ;
SHAUpdate(&tctx, k, lk) ;
SHAFinal(key, &tctx) ;
k = key ;
lk = SHA_DIGESTSIZE ;
}
/**** Inner Digest ****/
SHAInit(&ictx) ;
/* Pad the key for inner digest */ for (i = 0 ; i < lk ; ++i) buf[i] = k[i] ^ 0x36 ; for (i = lk ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x36 ;
SHAUpdate(&ictx, buf, SHA_BLOCKSIZE) ;
SHAUpdate(&ictx, d, ld) ;
SHAFinal(isha, &ictx) ;
/**** Outter Digest ****/
SHAInit(&octx) ;
/* Pad the key for outter digest */
for (i = 0 ; i < lk ; ++i) buf[i] = k[i] ^ 0x5C ; for (i = lk ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x5C ;
SHAUpdate(&octx, buf, SHA_BLOCKSIZE) ;
SHAUpdate(&octx, isha, SHA_DIGESTSIZE) ;
SHAFinal(osha, &octx) ;
/* truncate and print the results */ t = t > SHA_DIGESTSIZE ? SHA_DIGESTSIZE : t ; truncate(osha, out, t) ; pr_sha(stdout, out, t) ;
}