HMAC-SHA256

A MAC (Message Authentication Code) proves a message was created by someone who knows a secret key. SHA-256 alone is NOT a MAC — anyone can compute it. HMAC wraps a hash with a secret key:

HMAC(K, M) = SHA(K_outer || SHA(K_inner || M))
   where:
     K' = K (if len(K) <= block_size) else SHA(K)
     K' = K' padded to block_size with zeros
     K_inner = K' XOR (0x36 repeated block_size times)
     K_outer = K' XOR (0x5c repeated block_size times)

Block size for SHA-256 is 64 bytes.

Why this convoluted construction? Defends against length-extension and resists chosen-message attacks even if the underlying hash has weaknesses. Bellare et al. (1996) proved HMAC's security.

Used everywhere:

• TLS (PRF for key derivation, message authentication)
• AWS Signature V4 (signing API requests)
• JWT (JWS HS256 signing)
• HOTP / TOTP (one-time passwords)
• HKDF (key derivation)

A 32-byte HMAC-SHA256 tag verifies "this message wasn't tampered with AND came from someone with the key".