RFC 2202
Test Cases for HMAC-MD5 and HMAC-SHA-1
RFC 2202: Test Cases for HMAC-MD5 and HMAC-SHA-1 🎀
okay bestie, the title block first 💅
Who wrote it: Pau-Chen Cheng from IBM and Robert Glenn from NIST 🧚 Category: Informational, so it's info for the community, not an official standard 📚 Date: September 1997 🍓 Obsoletes / Updates: the block doesn't list anything it obsoletes or updates 🤷♀️
Status of This Memo ⭐
this memo gives info to the internet community. it does NOT specify an internet standard of any kind, and it's free to share, distribution is unlimited 🌈
Abstract 💜
okay so this doc gives you two sets of test cases, one for HMAC-MD5 and one for HMAC-SHA-1 🦋 HMAC is a message authentication function built on top of the MD5 hash and the SHA-1 hash. IPSEC and other protocols use both constructs to authenticate messages, so they matter lowkey a lot 🔐 the test cases and results here are meant to be a conformance test for anyone implementing HMAC-MD5 or HMAC-SHA-1. 💖
1. Introduction ✨
so the general recipe for building an HMAC message authentication function with a given hash is in section 2 of [HMAC], and we're not retyping it here bc that would be so extra 🙄 section 5 of [HMAC] also covers truncating the HMAC output, and the rule is to keep the more significant bits, which are the ones on the left when you assume network byte order (big-endian) 🍓
in sections 2 and 3 we give test cases for HMAC-MD5 and HMAC-SHA-1 🎀 each case has the key, the data, and the result. values are either hex numbers with a "0x" prefix, or ASCII strings in double quotes. if the value is an ASCII string, the HMAC computation DOES NOT include the trailing null character ('\0') in that string 👀
the C source for the HMAC-SHA-1 results is in the Appendix 🧚 it's meant to be simple and easy to read, so it's not optimized at all, no cap. the C source for computing HMAC-MD5 can be found in [MD5], OR you can make a simple tweak to the HMAC-SHA-1 code to get HMAC-MD5 code, which the Appendix explains 💅
the test cases here got cross-verified by three independent implementations: one from NIST and two from IBM Research 🔥 one of the IBM ones uses optimized code that's super different from the Appendix code. an implementation that agrees with the results in this doc should be interoperable with other similar implementations, but we're not claiming it's absolutely correct against the HMAC definition in [HMAC] 🫶
2. Test Cases for HMAC-MD5 🌸
test_case = 1
key = 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
key_len = 16
data = "Hi There"
data_len = 8
digest = 0x9294727a3638bb1c13f48ef8158bfc9d
test_case = 2
key = "Jefe"
key_len = 4
data = "what do ya want for nothing?"
data_len = 28
digest = 0x750c783e6ab0b503eaa86e310a5db738
test_case = 3
key = 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
key_len 16
data = 0xdd repeated 50 times
data_len = 50
digest = 0x56be34521d144c88dbb8c733f0e8b3f6
test_case = 4
key = 0x0102030405060708090a0b0c0d0e0f10111213141516171819
key_len 25
data = 0xcd repeated 50 times
data_len = 50
digest = 0x697eaf0aca3a3aea3a75164746ffaa79
test_case = 5
key = 0x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c
key_len = 16
data = "Test With Truncation"
data_len = 20
digest = 0x56461ef2342edc00f9bab995690efd4c
digest-96 0x56461ef2342edc00f9bab995
test_case = 6
key = 0xaa repeated 80 times
key_len = 80
data = "Test Using Larger Than Block-Size Key - Hash Key First"
data_len = 54
digest = 0x6b1ab7fe4bd7bf8f0b62e6ce61b9d0cd
test_case = 7
key = 0xaa repeated 80 times
key_len = 80
data = "Test Using Larger Than Block-Size Key and Larger
Than One Block-Size Data"
data_len = 73
digest = 0x6f630fad67cda0ee1fb1f562db3aa53e3. Test Cases for HMAC-SHA-1 🦋
test_case = 1
key = 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
key_len = 20
data = "Hi There"
data_len = 8
digest = 0xb617318655057264e28bc0b6fb378c8ef146be00
test_case = 2
key = "Jefe"
key_len = 4
data = "what do ya want for nothing?"
data_len = 28
digest = 0xeffcdf6ae5eb2fa2d27416d5f184df9c259a7c79
test_case = 3
key = 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
key_len = 20
data = 0xdd repeated 50 times
data_len = 50
digest = 0x125d7342b9ac11cd91a39af48aa17b4f63f175d3
test_case = 4
key = 0x0102030405060708090a0b0c0d0e0f10111213141516171819
key_len = 25
data = 0xcd repeated 50 times
data_len = 50
digest = 0x4c9007f4026250c6bc8414f9bf50c86c2d7235da
test_case = 5
key = 0x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c
key_len = 20
data = "Test With Truncation"
data_len = 20
digest = 0x4c1a03424b55e07fe7f27be1d58bb9324a9a5a04
digest-96 = 0x4c1a03424b55e07fe7f27be1
test_case = 6
key = 0xaa repeated 80 times
key_len = 80
data = "Test Using Larger Than Block-Size Key - Hash Key First"
data_len = 54
digest = 0xaa4ae5e15272d00e95705637ce8a3b55ed402112
test_case = 7
key = 0xaa repeated 80 times
key_len = 80
data = "Test Using Larger Than Block-Size Key and Larger
Than One Block-Size Data"
data_len = 73
digest = 0xe8e99d0f45237d786d6bbaa7965c7808bbff1a91
data_len = 20
digest = 0x4c1a03424b55e07fe7f27be1d58bb9324a9a5a04
digest-96 = 0x4c1a03424b55e07fe7f27be1
test_case = 6
key = 0xaa repeated 80 times
key_len = 80
data = "Test Using Larger Than Block-Size Key - Hash Key
First"
data_len = 54
digest = 0xaa4ae5e15272d00e95705637ce8a3b55ed402112
test_case = 7
key = 0xaa repeated 80 times
key_len = 80
data = "Test Using Larger Than Block-Size Key and Larger
Than One Block-Size Data"
data_len = 73
digest = 0xe8e99d0f45237d786d6bbaa7965c7808bbff1a91heads up: the section 3 listing repeats test cases 6 and 7 and has a few stray lines, and I kept all of it exactly as the original has it 👀
4. Security Considerations 🔐
this doc raises no security issues, no cap 🙈 but the strength of the HMAC construction is a big deal, so go read the discussion in [HMAC] before you ship anything. don't skip it!!
References 📚
- [HMAC] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.
- [MD5] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992.
- [SHA] NIST, FIPS PUB 180-1: Secure Hash Standard, April 1995.
- [OG] Oehler, M., and R. Glenn, "HMAC-MD5 IP Authentication with Replay Prevention", RFC 2085, February 1997.
- [CG] Chang, S., and R. Glenn, "HMAC-SHA IP Authentication with Replay Prevention", Work in Progress.
Authors' Addresses 🫶
Pau-Chen Cheng IBM T.J. Watson Research Center P.O.Box 704 Yorktown Heights, NY 10598
EMail: pau@watson.ibm.com
Robert Glenn NIST Building 820, Room 455 Gaithersburg, MD 20899
EMail: rob.glenn@nist.gov
Appendix 🧚
this appendix has the C reference code that implements HMAC-SHA-1 using an existing SHA-1 library. it assumes the SHA-1 library has similar APIs to the MD5 code described in RFC 1321. the code for HMAC-MD5 is similar, you just replace the strings "SHA" and "sha" with "MD5" and "md5". HMAC-MD5 code is also listed in RFC 2104. 💜
#ifndef SHA_DIGESTSIZE
#define SHA_DIGESTSIZE 20
#endif
#ifndef SHA_BLOCKSIZE
#define SHA_BLOCKSIZE 64
#endif
#ifndef MD5_DIGESTSIZE
#define MD5_DIGESTSIZE 16
#endif
#ifndef MD5_BLOCKSIZE
#define MD5_BLOCKSIZE 64
#endif
/* Function to print the digest */
void
pr_sha(FILE* fp, char* s, int t)
{
int i ;
fprintf(fp, "0x") ;
for (i = 0 ; i < t ; i++)
fprintf(fp, "%02x", s[i]) ;
fprintf(fp, "0) ;
}
void truncate
(
char* d1, /* data to be truncated */
char* d2, /* truncated data */
int len /* length in bytes to keep */
)
{
int i ;
for (i = 0 ; i < len ; i++) d2[i] = d1[i];
}
/* Function to compute the digest */
void
hmac_sha
(
char* k, /* secret key */
int lk, /* length of the key in bytes */
char* d, /* data */
int ld, /* length of data in bytes */
char* out, /* output buffer, at least "t" bytes */
int t
)
{
SHA_CTX ictx, octx ;
char isha[SHA_DIGESTSIZE], osha[SHA_DIGESTSIZE] ;
char key[SHA_DIGESTSIZE] ;
char buf[SHA_BLOCKSIZE] ;
int i ;
if (lk > SHA_BLOCKSIZE) {
SHA_CTX tctx ;
SHAInit(&tctx) ;
SHAUpdate(&tctx, k, lk) ;
SHAFinal(key, &tctx) ;
k = key ;
lk = SHA_DIGESTSIZE ;
}
/**** Inner Digest ****/
SHAInit(&ictx) ;
/* Pad the key for inner digest */
for (i = 0 ; i < lk ; ++i) buf[i] = k[i] ^ 0x36 ;
for (i = lk ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x36 ;
SHAUpdate(&ictx, buf, SHA_BLOCKSIZE) ;
SHAUpdate(&ictx, d, ld) ;
SHAFinal(isha, &ictx) ;
/**** Outter Digest ****/
SHAInit(&octx) ;
/* Pad the key for outter digest */
for (i = 0 ; i < lk ; ++i) buf[i] = k[i] ^ 0x5C ;
for (i = lk ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x5C ;
SHAUpdate(&octx, buf, SHA_BLOCKSIZE) ;
SHAUpdate(&octx, isha, SHA_DIGESTSIZE) ;
SHAFinal(osha, &octx) ;
/* truncate and print the results */
t = t > SHA_DIGESTSIZE ? SHA_DIGESTSIZE : t ;
truncate(osha, out, t) ;
pr_sha(stdout, out, t) ;
}📦 where this page comes from
- ietf: rfc2202 1997-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms