HMAC(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

✨ HMAC 💖 (that's HMAC(3SSL) bestie, from the OpenSSL manual, section 3)

okay so sit down, grab a strawberry 🍓, because we're talking about HMAC — the message authentication code, like, the crypto girlies' fave keyed hash function. this page is a whole saga: one iconic function that slays, and a bunch of deprecated ones that are giving "retired but still in the group chat."

🌸 NAME 🌸

HMAC, HMAC_CTX_new, HMAC_CTX_reset, HMAC_CTX_free, HMAC_Init, HMAC_Init_ex, HMAC_Update, HMAC_Final, HMAC_CTX_copy, HMAC_CTX_set_flags, HMAC_CTX_get_md, HMAC_size — HMAC message authentication code 💅

🎀 SYNOPSIS 🎀

#include <openssl/hmac.h>

unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
                    const unsigned char *data, size_t data_len,
                    unsigned char *md, unsigned int *md_len);
⚠️ heads up: the following functions have been deprecated since OpenSSL 3.0, and can be hidden entirely by defining OPENSSL_API_COMPAT with a suitable version value, see openssl_user_macros(7):
HMAC_CTX *HMAC_CTX_new(void);
int HMAC_CTX_reset(HMAC_CTX *ctx);

int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int key_len,
                 const EVP_MD *md, ENGINE *impl);
int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len);
int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len);

void HMAC_CTX_free(HMAC_CTX *ctx);

int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx);
void HMAC_CTX_set_flags(HMAC_CTX *ctx, unsigned long flags);
const EVP_MD *HMAC_CTX_get_md(const HMAC_CTX *ctx);

size_t HMAC_size(const HMAC_CTX *e);

and this one has been deprecated since OpenSSL 1.1.0, and can also be hidden entirely by defining OPENSSL_API_COMPAT with a suitable version value, see openssl_user_macros(7):

int HMAC_Init(HMAC_CTX *ctx, const void *key, int key_len,
              const EVP_MD *md);

🦋 DESCRIPTION 🦋

so HMAC is a MAC — a message authentication code — which is basically a keyed hash function used for message authentication, built on top of a hash function. it's giving trust but verified. 😌

HMAC() computes the message authentication code of the data_len bytes at data, using the hash function evp_md and the key key, which is key_len bytes long. oh and btw the key can also be NULL with key_len being 0, no biggie.

it places the result in md — and md must have space for the output of the hash function, which is no more than EVP_MAX_MD_SIZE bytes. if md is NULL, the digest goes into a static array instead. the size of the output gets placed in md_len, unless md_len is NULL.

🔥 IMPORTANT: passing a NULL value for md to use that static array is not thread safe. like, not even a little. do not do this in your multithreaded girlboss era.

evp_md is a message digest such as EVP_sha1(), EVP_ripemd160() etc. but bestie — HMAC does not support variable output length digests such as EVP_shake128() and EVP_shake256(). it simply will not do it. 💀

HMAC() uses the default OSSL_LIB_CTX. use EVP_Q_mac(3) instead if a library context is required.

✨ plot twist: all of the functions described below are deprecated. applications should instead use EVP_MAC_CTX_new(3), EVP_MAC_CTX_free(3), EVP_MAC_init(3), EVP_MAC_update(3) and EVP_MAC_final(3), or the 'quick' single-shot MAC function EVP_Q_mac(3). that's the glow-up. ✨

HMAC_CTX_new() creates a new HMAC_CTX in heap memory. new context, new me. 💖

HMAC_CTX_reset() clears an existing HMAC_CTX and its associated resources, making it suitable for new computations as if it had been newly created with HMAC_CTX_new(). fresh start energy.

HMAC_CTX_free() erases the key and other data from the HMAC_CTX, releases any associated resources and finally frees the HMAC_CTX itself. if the argument is NULL, nothing is done. it simply does nothing. no drama. 🙈

the following functions may be used if the message is not completely stored in memory:

HMAC_Init_ex() initializes or reuses an HMAC_CTX structure to use the hash function evp_md and key key. if both are NULL, or if key is NULL and evp_md is the same as the previous call, then the existing key is reused. ctx must have been created with HMAC_CTX_new() before the first use of an HMAC_CTX in this function. impl must be NULL.

if HMAC_Init_ex() is called with key NULL and evp_md is not the same as the previous digest used by ctx, then an error is returned — because reuse of an existing key with a different digest is not supported. it's giving boundaries. 🚫

HMAC_Init() initializes an HMAC_CTX structure to use the hash function evp_md and the key key, which is key_len bytes long.

HMAC_Update() can be called repeatedly with chunks of the message to be authenticated (len bytes at data). little bites, one at a time 🍓

HMAC_Final() places the message authentication code in md, which must have space for the hash function output.

HMAC_CTX_copy() copies all of the internal state from sctx into dctx. twin behavior, lowkey.

HMAC_CTX_set_flags() applies the specified flags to the internal EVP_MD_CTXs. these flags have the same meaning as for EVP_MD_CTX_set_flags(3).

HMAC_CTX_get_md() returns the EVP_MD that has previously been set for the supplied HMAC_CTX.

HMAC_size() returns the length in bytes of the underlying hash function output.

👑 RETURN VALUES 👑

HMAC() returns a pointer to the message authentication code, or NULL if an error occurred.

HMAC_CTX_new() returns a pointer to a new HMAC_CTX on success, or NULL if an error occurred.

HMAC_CTX_reset(), HMAC_Init_ex(), HMAC_Update(), HMAC_Final() and HMAC_CTX_copy() return 1 for success or 0 if an error occurred.

HMAC_CTX_get_md() returns the EVP_MD previously set for the supplied HMAC_CTX, or NULL if no EVP_MD has been set.

HMAC_size() returns the length in bytes of the underlying hash function output, or zero on error.

🌈 CONFORMING TO 🌈

RFC 2104 — she's certified, she's official, she's iconic. 🫶

⭐ SEE ALSO ⭐

SHA1(3), EVP_Q_mac(3), evp(7)

iykyk 💜

📜 HISTORY 📜

  • all functions except for HMAC() were deprecated in OpenSSL 3.0.
  • HMAC_CTX_init() was replaced with HMAC_CTX_reset() in OpenSSL 1.1.0.
  • HMAC_CTX_cleanup() existed in OpenSSL before version 1.1.0.
  • HMAC_CTX_new(), HMAC_CTX_free() and HMAC_CTX_get_md() are new in OpenSSL 1.1.0.
  • HMAC_Init_ex(), HMAC_Update() and HMAC_Final() did not return values in OpenSSL before version 1.0.0.

Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, you ate it up 💅✨ no cap, this was Version 4.0.3, dated 2026-09-29, and it's the HMAC(3SSL) page — periodt. go forth and authenticate your messages responsibly, mwah 🎀🦋🧚

📦 where this page comes from