I am trying to implement the HMAC algorithm in Mathematica. The algorithm is a relatively simple way of signing messages with a key.

Here is some pseudocode from Wikipedia:

enter image description here

My attempt:

hash[string_String, method_String : "SHA256"] := FromCharacterCode @ 
    Interpreter["HexInteger"] @ StringPartition[IntegerString[Hash[string, method], 16], 2];

HMAC[key_String, message_String, method_String : "SHA256", blockSize_Integer : 64] :=
    {char54, char92, key2, ipad, opad},
    {char54, char92} = FromCharacterCode /@ {54, 92};
    key2 = Switch[StringLength @ key,
        blockSize, key,
        l_ /; l > blockSize, hash[key, method],
        _, StringPadRight[key, blockSize, FromCharacterCode @ 0]];
    ipad = FromCharacterCode[BitXor @@ Map[ToCharacterCode, {StringRepeat[char54, blockSize], key2}]];
    opad = FromCharacterCode[BitXor @@ Map[ToCharacterCode, {StringRepeat[char92, blockSize], key2}]];
    hash @ StringJoin[opad, hash @ StringJoin[ipad, message]]];

A Java analog for testing:


javaHMAC[key_, message_] := Module[
    {mac, keySpec, bytes},
        mac = Mac`getInstance["HmacSHA256"];
        keySpec = JavaNew["javax.crypto.spec.SecretKeySpec", ToCharacterCode[key], "HmacSHA256"];
        mac @ init[keySpec];
        bytes = mac @ doFinal[ToCharacterCode[message]] + 256;
        FromCharacterCode @ bytes]];

In my particular case I am using this to communicate with Amazon Web Services. At the bottom of this page they provide a test vector which involves repeated HMAC computations. For these inputs (using outputs as the key for the next input)

messages = {"20120215", "us-east-1", "iam", "aws4_request"};

we should obtain

"kSecret  = '41575334774a616c725855746e46454d492f4b374d44454e472b62507852666943594558414d504c454b4559'
kDate    = '969fbb94feb542b71ede6f87fe4d5fa29c789342b0f407474670f0c2489e0a0d'
kRegion  = '69daa0209cd9c5ff5c8ced464a696fd4252e981430b10e3d3fd8e2f197d7a70c'
kService = 'f72cfd46f26bc4643f06a11eabb6c0ba18780c19a8da0c31ace671265e3c87fa'
kSigning = 'f4780e2d9f65fa895f9c67b32ce1baf0b0d8a43505a000a1a9e090d414db404d'";
StringSplit[StringSplit[%, "\n"], "= "][[All, 2]];
correct = StringReplace[%, "'" -> ""];

My function passes this test. Swapping it out for the Java method will show that the same results are obtained.

FoldList[HMAC, key, messages];
StringJoin /@ IntegerString[ToCharacterCode @ %, 16, 2];
MapThread[SequenceAlignment, {%, correct}];
% // Column






But on a slightly different set of messages, from the bottom of this page, my function fails on one of the steps.

messages2 = {"20110909", "us-east-1", "iam", "aws4_request"};

FoldList[HMAC, key, messages2];
hex2 = StringJoin /@ IntegerString[ToCharacterCode @ %, 16, 2];

FoldList[javaHMAC, key, messages2];
javaHex2 = StringJoin /@ IntegerString[ToCharacterCode @ %, 16, 2];

MapThread[SequenceAlignment, {hex2, javaHex2}] // Column






In this case the Java output matches the answer provided by AWS.

I cannot get this implementation to work either.

  • $\begingroup$ I don't understand your custom hash as the pseudocode from Wikipedia $\endgroup$
    – yode
    Oct 18, 2016 at 11:49
  • $\begingroup$ I don't understand your custom hash as the pseudocode from Wikipedia $\endgroup$
    – yode
    Oct 18, 2016 at 11:49

1 Answer 1


Try something like

hash[string_String, method_String: "SHA256"] :=
    FromCharacterCode@IntegerDigits[Hash[string, method], 256, 32]

The original method you used will drop leading zeros. You can even see that in your example data set:


ETA: I should have mentioned that passing in the algorithm but then hard-coding the length of the expected hash to 32 bytes is extremely sloppy of me. Do not do that in production code.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.