The HMAC Trap: Security or Illusion?

The talk examines how HMAC, a keyed hash used to confirm that a message is authentic and unchanged, gets misused in authentication. The speaker built a small Python client and server lab, first with MD5 and then SHA-256, and showed that a captured message and tag can be cracked offline when the key is weak. Intercepting traffic through a proxy showed that tampered messages and tags were rejected, yet recovering the key let forged messages pass.

Further demos covered a dictionary attack against an admin account's key, replay of messages when timestamps were missing or ignored, and a timing side channel created by a non-constant-time tag comparison. A logic flaw where the server accepted any tag was also shown, along with JSON Web Tokens that accepted the none algorithm or used a guessable signing secret. Each case was presented as a simple proof of concept.

The practical guidance centred on key management: long random keys rather than passwords, rotation and revocation, never hardcoding keys, least-privilege access, timestamps and nonces to block replay, constant-time comparison functions, and rejecting the none algorithm in tokens. The closing point was that HMAC itself is not broken but is often misused and mismanaged. Audience questions covered whether timing attacks are practical over a network, whether password-derived keys are acceptable, and the effect of quantum computing, and the speaker left the network timing question open.