ccna and ccnp training

ccna and ccnp training.7.2.3.1 Key Hash Message Authentication CodeIn cryptography, a key hash message authentication code (HMAC or KHMAC ) is a type of Message Authentication Code (MAC). HMAC provides authentication protection for data integrity by using an additional secretkey as input to the hash function. HMAC is calculated using a specialized algorithm that combines a cryptographic hash function and a secret key. The hash function is the basis of the HMAC protection mechanism.Only the sender and receiver know the secret key, and the output of the hash function depends on the input data and the secret key. Only the communicating party that knows the secret key can compute a digest of the HMAC function. This feature guards against man-in-the-middle attacks and provides authentication of the data source. If two parties share a secret key and use the HMAC function for authentication, the HMAC digest of a correctly constructed message received by one party indicates that the other party is the source of the message, since it is the only other entity that has the secret key. The cryptographic strength of HMAC depends on the cryptographic strength of the underlying hash function, the size and quality of the key, and the length of the output hash (singlebit for bit). Cisco technology uses two known HMAC functions: Key MD5 (Keyed MD5, HMAC-MD5), based on the MD5 hashing algorithm.Key SHA.1 (Keyed SHA-1,HMAC-SHA-1), based on the SHA.1 hash U algorithm. When an HMAC digest is created, data of arbitrary length is entered into the hash function along with a secret key. The result is a fixed-length hash that depends on the data and the secret key.Care must be taken to distribute the key to relevant communicating parties because if the key is stolen, other communicating parties will be able to forge and alter the packet of information and compromise the integrity of the data.7.2.3.2 HMAC OperationsConsider an example where the sender wants to ensure that the message is not altered in transit and wants to provide a way for the receiver to authenticate the source of the message. The sender device inputs data and a secret key to a hashing algorithm that computes a fixed-length HMAC digest or fingerprint. This authenticated fingerprint is then attached to the message and sent to the receiver.The receiving device removes the fingerprint from the message and inputs it to the same hash function using the plaintext message and its own secret key. If the fingerprint computed by the receiving device is the same as the one being sent, the message has not been changed. Also, the source of the message is authenticated, since only the sender has a copy of the shared secret key. The HMAC function ensures the authenticity of the message.IPSec VirtualPrivateNetworks (VPNs) rely on the HMAC function to authenticate the source of each message and provide data integrity checks.