HMAC算法原理与Java实现教程

HMAC算法原理

HMAC（Hash-based Message Authentication Code，基于哈希的消息认证码）是一种使用加密哈希函数结合密钥进行消息认证的技术。

核心原理

密钥处理：
- 如果密钥比哈希函数的块长度长，先对密钥进行哈希
- 如果密钥比块长度短，则在末尾补零
内部填充：
- 将处理后的密钥与一个内部填充值（0x36重复多次）进行异或运算
外部填充：
- 将处理后的密钥与一个外部填充值（0x5C重复多次）进行异或运算
计算过程：
- 先计算 hash((key ⊕ ipad) || message)（内部哈希）
- 再计算 hash((key ⊕ opad) || 内部哈希结果)（最终HMAC）

安全性特点

可以防范长度扩展攻击
密钥不直接暴露
安全性依赖于底层哈希函数

Java实现HMAC

Java通过javax.crypto.Mac类提供了HMAC的实现支持。

基础实现示例

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;

public class HMACExample {

    public static String calculateHMAC(String data, String key, String algorithm) 
            throws NoSuchAlgorithmException, InvalidKeyException {
        SecretKeySpec secretKeySpec = new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), algorithm);
        Mac mac = Mac.getInstance(algorithm);
        mac.init(secretKeySpec);
        byte[] hmacBytes = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(hmacBytes);
    }

    public static void main(String[] args) {
        try {
            String message = "这是要认证的消息";
            String secretKey = "这是一个秘密密钥";
            
            // 支持的算法: HmacMD5, HmacSHA1, HmacSHA256, HmacSHA384, HmacSHA512
            String hmacSHA256 = calculateHMAC(message, secretKey, "HmacSHA256");
            System.out.println("HMAC-SHA256: " + hmacSHA256);
            
            String hmacSHA512 = calculateHMAC(message, secretKey, "HmacSHA512");
            System.out.println("HMAC-SHA512: " + hmacSHA512);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

进阶实现：带时间戳的HMAC认证

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.time.Instant;
import java.util.Base64;

public class TimeBasedHMAC {

    private static final String HMAC_ALGORITHM = "HmacSHA256";
    private static final long TTL = 300; // 有效期5分钟(300秒)

    public static String generateTimeBasedToken(String apiKey, String secret) 
            throws NoSuchAlgorithmException, InvalidKeyException {
        long timestamp = Instant.now().getEpochSecond();
        String data = apiKey + "|" + timestamp;
        return calculateHMAC(data, secret, HMAC_ALGORITHM) + "|" + timestamp;
    }

    public static boolean verifyTimeBasedToken(String token, String apiKey, String secret) 
            throws NoSuchAlgorithmException, InvalidKeyException {
        String[] parts = token.split("\\|");
        if (parts.length != 2) return false;
        
        String receivedHmac = parts[0];
        long timestamp = Long.parseLong(parts[1]);
        
        // 检查时间戳是否过期
        long currentTime = Instant.now().getEpochSecond();
        if (currentTime - timestamp > TTL) {
            return false;
        }
        
        String data = apiKey + "|" + timestamp;
        String computedHmac = calculateHMAC(data, secret, HMAC_ALGORITHM);
        
        return computedHmac.equals(receivedHmac);
    }

    private static String calculateHMAC(String data, String key, String algorithm) 
            throws NoSuchAlgorithmException, InvalidKeyException {
        SecretKeySpec secretKeySpec = new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), algorithm);
        Mac mac = Mac.getInstance(algorithm);
        mac.init(secretKeySpec);
        byte[] hmacBytes = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(hmacBytes);
    }

    public static void main(String[] args) {
        try {
            String apiKey = "user123";
            String secret = "secureSecretKey123!";
            
            // 生成令牌
            String token = generateTimeBasedToken(apiKey, secret);
            System.out.println("Generated Token: " + token);
            
            // 验证令牌
            boolean isValid = verifyTimeBasedToken(token, apiKey, secret);
            System.out.println("Token is valid: " + isValid);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}