RE: CBV
"Seth Goodman" <[email protected]>
| Newsgroups | gmane.mail.spam.srs.general |
|---|---|
| Message-ID | <[email protected]> |
> From: Tony Finch > Sent: Friday, May 07, 2004 6:41 AM > > <...> > I think there's a bit of miscommunication here. HMAC (described in RFC > 2104, using either MD5 or SHA1) is the correct way to create the hashes. > Creating a MAC by simply taking the MD5 or SHA1 of a secret concatenated > with the public data to be authenticated is not good enough. > > RFC 2104 has references that describe why this is the case. Yes, Mark and I have both been lazy in our description of the hash signing mechanism. My intention was to use the same SHA-1 HMAC that SRS uses and is described in your reference. We should probably describe the output as something like, "the SHA-1 HMAC of (data) using (secret) as a key". -- Seth Goodman