hesela.devHMAC
HMAC is a message authentication code constructed from a cryptographic hash function and a shared secret key.
Generating and checking a tag uses the secret key. HMAC authenticates the covered bytes under the chosen algorithm and key assumptions; it does not encrypt them. HMAC-SHA-256 is one specific instantiation. [1] [2]
A payload-only tag does not by itself establish a storage address or version. The surrounding protocol must bind the intended context, for example through unambiguous authenticated fields checked against trusted expectations. A previously valid record can still pass its tag check when replayed under the same key. [3]
The authenticated input must preserve field boundaries. Hesela's selected address/generation pairs produce identical concatenated bytes even with the same role label; the fixed tuple distinguishes them. This is an encoding ambiguity, not an HMAC collision. [4]
The original MAC security model requires a forgery on a message not previously authenticated. Replaying an already valid message/tag pair is outside that event, so freshness remains a protocol responsibility. [5]
Relations
- related
- Cryptographic hash function, Checksum, Authenticated encryption, dm-integrity, Replay attack, Rollback protection, Message authentication code (MAC), Hash domain separation
Limitations
- Authentication does not provide confidentiality, repair damaged data or establish that a storage write survived a crash. [1, 3]
- A valid tag does not establish freshness or distinguish which holder of the shared key generated it. [1, 3]
Citations
- RFC 2104: HMAC construction and shared-key authentication, sections 1-2
- RFC 4231: HMAC-SHA-256 instantiation and test cases 1 through 6
- Hesela: HMAC authenticates bytes, not the expected version
- Hesela: A role label does not separate the fields
- Bellare, Canetti and Krawczyk (1996): MAC security definition, section 2.1
Sources & caveats
- RFC 2104 is used for the construction, not its historical MD5 or SHA-1 recommendations.
- The storage-context and replay examples are deterministic synthetic fixtures using a public test key, not device measurements or a security proof.