Sertifikat olingYANGIW3Schools ilovasiiOS va AndroidSarguzashtni boshlang

Hmac ma’lumotnomasi

ULASHISH

Hmac obyekti

Hmac klassi Node.js crypto modulining bir qismidir. U kriptografik HMAC (Xesh-asoslangan xabar autentifikatsiya kodi) dayjestlarini yaratish usulini taqdim etadi. HMAC misollari crypto.createHmac() usuli yordamida yaratiladi.

HMAC kriptografik xesh funksiyasini maxfiy kalit bilan birlashtirib, ma’lumotlarning yaxlitligini va autentifikatsiyasini ta’minlovchi xabar autentifikatsiya kodini ishlab chiqaradi.

Kripto modulini import qilish

// Import the crypto module
const crypto = require('crypto');

// Create an Hmac object
const hmac = crypto.createHmac('sha256', 'your-secret-key');
Misolni ishga tushirish »

Hmac usullari

Metod Tavsif
hmac.update(data[, inputEncoding]) Hmac tarkibini berilgan data bilan yangilaydi. Agar inputEncoding ko‘rsatilgan bo‘lsa, data belgilangan kodlashdan foydalanadigan stringdir; aks holda, data buffer, TypedArray yoki DataView hisoblanadi. Ushbu metodni yangi ma’lumotlar bilan bir necha marta chaqirish mumkin.
hmac.digest([encoding]) hmac.update() yordamida Hmac-ga uzatilgan barcha ma’lumotlarning HMAC dayjestini hisoblaydi. Agar encoding berilsa, string qaytariladi; aks holda buffer qaytariladi. Ushbu usul chaqirilgandan so‘ng, Hmac obyektini boshqa ishlatib bo‘lmaydi.

Asosiy Hmac misoli

Quyidagi misol stringning HMAC dayjestini qanday yaratishni ko‘rsatadi:

const crypto = require('crypto');

// Data to authenticate
const data = 'Hello, World!';

// Secret key
const secretKey = 'my-secret-key';

// Create an Hmac object
const hmac = crypto.createHmac('sha256', secretKey);

// Update the hmac with data
hmac.update(data);

// Get the digest in hex format
const digest = hmac.digest('hex');

console.log('Data:', data);
console.log('Secret Key:', secretKey);
console.log('HMAC-SHA256:', digest);
Misolni ishga tushirish »

Turli HMAC algoritmlarini solishtirish

Ushbu misol turli xil xesh algoritmlarini HMAC bilan taqqoslaydi:

const crypto = require('crypto');

// Data to authenticate
const data = 'Node.js Crypto HMAC Example';

// Secret key
const secretKey = 'my-secret-key';

// Function to create HMAC with different algorithms
function createHmacWithAlgorithm(algorithm, data, key) {
  const hmac = crypto.createHmac(algorithm, key);
  hmac.update(data);
  return hmac.digest('hex');
}

// Test various HMAC algorithms
const algorithms = ['md5', 'sha1', 'sha256', 'sha512', 'sha3-256', 'sha3-512'];

console.log(`Data: "${data}"`);
console.log(`Secret Key: "${secretKey}"`);
console.log('------------------------------------');

algorithms.forEach(algorithm => {
  try {
    const digest = createHmacWithAlgorithm(algorithm, data, secretKey);
    console.log(`HMAC-${algorithm}: ${digest}`);
    console.log(`Length: ${digest.length / 2} bytes (${digest.length * 4} bits)`);
    console.log('------------------------------------');
  } catch (error) {
    console.log(`HMAC-${algorithm}: Not supported - ${error.message}`);
    console.log('------------------------------------');
  }
});
Misolni ishga tushirish »

Bir nechta yangilanishlarga ega HMAC

Dijestni hisoblashdan oldin HMAC-ni bir nechta ma’lumotlar bilan yangilashingiz mumkin:

const crypto = require('crypto');

// Secret key
const secretKey = 'my-secret-key';

// Create an Hmac object
const hmac = crypto.createHmac('sha256', secretKey);

// Update the hmac with multiple pieces of data
hmac.update('First part of the data.');
hmac.update(' Second part of the data.');
hmac.update(' Third part of the data.');

// Calculate the final digest
const digest = hmac.digest('hex');

console.log('Combined data: First part of the data. Second part of the data. Third part of the data.');
console.log('Secret Key:', secretKey);
console.log('HMAC-SHA256:', digest);

// You can achieve the same result with a single update
const singleHmac = crypto.createHmac('sha256', secretKey);
singleHmac.update('First part of the data. Second part of the data. Third part of the data.');
const singleDigest = singleHmac.digest('hex');

console.log('Single update HMAC matches multiple updates?', singleDigest === digest);
Misolni ishga tushirish »

Turli xil kodlashlarga ega HMAC

Siz HMAC dayjestini turli xil kodlashlarda olishingiz mumkin:

const crypto = require('crypto');

// Data to authenticate
const data = 'Hello, Node.js!';

// Secret key
const secretKey = 'my-secret-key';

// Function to create HMAC and get digest in different encodings
function createHmacWithEncoding(algorithm, data, key, encoding) {
  const hmac = crypto.createHmac(algorithm, key);
  hmac.update(data);
  return hmac.digest(encoding);
}

// Create HMAC with SHA-256 and display in different encodings
console.log(`Data: "${data}"`);
console.log(`Secret Key: "${secretKey}"`);
console.log(`HMAC-SHA256 (hex): ${createHmacWithEncoding('sha256', data, secretKey, 'hex')}`);
console.log(`HMAC-SHA256 (base64): ${createHmacWithEncoding('sha256', data, secretKey, 'base64')}`);
console.log(`HMAC-SHA256 (base64url): ${createHmacWithEncoding('sha256', data, secretKey, 'base64url')}`);
console.log(`HMAC-SHA256 (binary): ${createHmacWithEncoding('sha256', data, secretKey, 'binary')}`);

// Get the digest as a Buffer (no encoding)
const hmac = crypto.createHmac('sha256', secretKey);
hmac.update(data);
const buffer = hmac.digest();
console.log('HMAC-SHA256 (Buffer):', buffer);
console.log('Buffer length:', buffer.length, 'bytes');
Misolni ishga tushirish »

HMAC yordamida fayl autentifikatsiyasi

Siz fayl mazmunining HMAC dayjestini yaratishingiz mumkin:

const crypto = require('crypto');
const fs = require('fs');

// Function to create HMAC for a file using streams
function createHmacForFile(filePath, algorithm, key) {
  return new Promise((resolve, reject) => {
    // Create Hmac object
    const hmac = crypto.createHmac(algorithm, key);
    
    // Create read stream
    const stream = fs.createReadStream(filePath);
    
    // Handle stream events
    stream.on('data', (data) => {
      hmac.update(data);
    });
    
    stream.on('end', () => {
      const digest = hmac.digest('hex');
      resolve(digest);
    });
    
    stream.on('error', (error) => {
      reject(error);
    });
  });
}

// Secret key
const secretKey = 'file-authentication-key';

// Example usage (adjust file path as needed)
const filePath = 'example.txt';

// Create a test file if it doesn't exist
if (!fs.existsSync(filePath)) {
  fs.writeFileSync(filePath, 'This is a test file for HMAC authentication.\n'.repeat(100));
  console.log(`Created test file: ${filePath}`);
}

// Create HMAC for the file with different algorithms
Promise.all([
  createHmacForFile(filePath, 'md5', secretKey),
  createHmacForFile(filePath, 'sha1', secretKey),
  createHmacForFile(filePath, 'sha256', secretKey)
])
.then(([md5Digest, sha1Digest, sha256Digest]) => {
  console.log(`File: ${filePath}`);
  console.log(`Secret Key: ${secretKey}`);
  console.log(`HMAC-MD5: ${md5Digest}`);
  console.log(`HMAC-SHA1: ${sha1Digest}`);
  console.log(`HMAC-SHA256: ${sha256Digest}`);
  
  // Store the HMAC for later verification
  fs.writeFileSync(`${filePath}.hmac`, sha256Digest);
  console.log(`HMAC stored in: ${filePath}.hmac`);
})
.catch(error => {
  console.error('Error creating HMAC for file:', error.message);
});
Misolni ishga tushirish »

HMAC yordamida fayl yaxlitligini tekshirish

Ushbu misol avval yaratilgan HMAC yordamida faylning yaxlitligini tekshirishni ko‘rsatadi:

const crypto = require('crypto');
const fs = require('fs');

// Function to create HMAC for a file
function createHmacForFile(filePath, algorithm, key) {
  return new Promise((resolve, reject) => {
    const hmac = crypto.createHmac(algorithm, key);
    const stream = fs.createReadStream(filePath);
    
    stream.on('data', (data) => {
      hmac.update(data);
    });
    
    stream.on('end', () => {
      const digest = hmac.digest('hex');
      resolve(digest);
    });
    
    stream.on('error', (error) => {
      reject(error);
    });
  });
}

// Function to verify file integrity
async function verifyFileIntegrity(filePath, storedHmacPath, algorithm, key) {
  try {
    // Read the stored HMAC
    const storedHmac = fs.readFileSync(storedHmacPath, 'utf8').trim();
    
    // Calculate the current HMAC
    const currentHmac = await createHmacForFile(filePath, algorithm, key);
    
    // Compare the HMACs
    const isValid = currentHmac === storedHmac;
    
    return {
      isValid,
      storedHmac,
      currentHmac
    };
  } catch (error) {
    throw new Error(`Verification failed: ${error.message}`);
  }
}

// Secret key (must be the same as used to create the original HMAC)
const secretKey = 'file-authentication-key';

// Example usage
const filePath = 'example.txt';
const hmacPath = `${filePath}.hmac`;

// Verify the file integrity
verifyFileIntegrity(filePath, hmacPath, 'sha256', secretKey)
  .then(result => {
    console.log(`File: ${filePath}`);
    console.log(`HMAC file: ${hmacPath}`);
    console.log(`Integrity verified: ${result.isValid}`);
    
    if (!result.isValid) {
      console.log('Stored HMAC:', result.storedHmac);
      console.log('Current HMAC:', result.currentHmac);
      console.log('The file has been modified!');
    } else {
      console.log('The file is intact and has not been tampered with.');
    }
  })
  .catch(error => {
    console.error('Error:', error.message);
  });
Misolni ishga tushirish »

Har xil turdagi kalitlardan foydalanish

HMAC har xil turdagi kalitlar bilan ishlashi mumkin:

const crypto = require('crypto');

// Data to authenticate
const data = 'Data to authenticate with HMAC';

// Function to create HMAC with different key types
function createHmacWithKey(algorithm, data, key, keyType) {
  const hmac = crypto.createHmac(algorithm, key);
  hmac.update(data);
  return {
    keyType,
    hmac: hmac.digest('hex')
  };
}

console.log(`Data: "${data}"`);
console.log('------------------------------------');

// 1. String key
const stringKey = 'my-secret-key';
console.log(createHmacWithKey('sha256', data, stringKey, 'String key'));

// 2. Buffer key
const bufferKey = Buffer.from('buffer-secret-key');
console.log(createHmacWithKey('sha256', data, bufferKey, 'Buffer key'));

// 3. TypedArray key
const uint8ArrayKey = new Uint8Array([72, 101, 108, 108, 111]); // "Hello" in ASCII
console.log(createHmacWithKey('sha256', data, uint8ArrayKey, 'Uint8Array key'));

// 4. DataView key
const arrayBuffer = new ArrayBuffer(5);
const dataView = new DataView(arrayBuffer);
dataView.setUint8(0, 72);  // H
dataView.setUint8(1, 101); // e
dataView.setUint8(2, 108); // l
dataView.setUint8(3, 108); // l
dataView.setUint8(4, 111); // o
console.log(createHmacWithKey('sha256', data, dataView, 'DataView key'));

// 5. KeyObject (recommended for sensitive keys)
const keyObject = crypto.createSecretKey(Buffer.from('key-object-secret'));
console.log(createHmacWithKey('sha256', data, keyObject, 'KeyObject'));
Misolni ishga tushirish »

API autentifikatsiyasi uchun HMAC

HMAC odatda API autentifikatsiyasi uchun ishlatiladi, bu yerda server va mijoz maxfiy kalitni baham ko‘radi:

const crypto = require('crypto');

// Simulated API request
function createApiRequest(apiKey, secretKey, method, path, queryParams, body, timestamp) {
  // Create the string to sign
  const stringToSign = [
    method.toUpperCase(),
    path,
    new URLSearchParams(queryParams).toString(),
    typeof body === 'string' ? body : JSON.stringify(body || {}),
    timestamp
  ].join('\n');
  
  // Create HMAC signature
  const hmac = crypto.createHmac('sha256', secretKey);
  hmac.update(stringToSign);
  const signature = hmac.digest('hex');
  
  // Return the request with authentication headers
  return {
    url: `https://api.example.com${path}?${new URLSearchParams(queryParams)}`,
    method,
    headers: {
      'Content-Type': 'application/json',
      'X-Api-Key': apiKey,
      'X-Timestamp': timestamp,
      'X-Signature': signature
    },
    body: body || {},
    // For debugging/verification
    stringToSign
  };
}

// Simulate API server verification
function verifyApiRequest(apiKey, secretKey, method, path, queryParams, body, timestamp, signature) {
  // Recreate the string that was signed
  const stringToSign = [
    method.toUpperCase(),
    path,
    new URLSearchParams(queryParams).toString(),
    typeof body === 'string' ? body : JSON.stringify(body || {}),
    timestamp
  ].join('\n');
  
  // Verify HMAC signature
  const hmac = crypto.createHmac('sha256', secretKey);
  hmac.update(stringToSign);
  const expectedSignature = hmac.digest('hex');
  
  return {
    isValid: crypto.timingSafeEqual(
      Buffer.from(signature, 'hex'),
      Buffer.from(expectedSignature, 'hex')
    ),
    expectedSignature
  };
}

// API credentials
const apiKey = 'user123';
const secretKey = 'very-secret-api-key';

// Create a request
const timestamp = new Date().toISOString();
const request = createApiRequest(
  apiKey,
  secretKey,
  'POST',
  '/api/v1/users',
  { filter: 'active' },
  { name: 'John Doe', email: 'john@example.com' },
  timestamp
);

console.log('API Request:');
console.log(`URL: ${request.url}`);
console.log(`Method: ${request.method}`);
console.log('Headers:', request.headers);
console.log('Body:', request.body);
console.log('\nString that was signed:');
console.log(request.stringToSign);

// Server verifies the request
const verification = verifyApiRequest(
  apiKey,
  secretKey,
  'POST',
  '/api/v1/users',
  { filter: 'active' },
  { name: 'John Doe', email: 'john@example.com' },
  timestamp,
  request.headers['X-Signature']
);

console.log('\nVerification result:');
console.log(`Is signature valid? ${verification.isValid}`);

// Try with tampered data
const tamperedVerification = verifyApiRequest(
  apiKey,
  secretKey,
  'POST',
  '/api/v1/users',
  { filter: 'active' },
  { name: 'Jane Doe', email: 'jane@example.com' }, // Changed body
  timestamp,
  request.headers['X-Signature']
);

console.log('\nTampered verification result:');
console.log(`Is signature valid? ${tamperedVerification.isValid}`);
Misolni ishga tushirish »

HMAC va oddiy xash

Ushbu misol oddiy xesh va HMAC o‘rtasidagi farqni ko‘rsatadi:

const crypto = require('crypto');

// Data and keys
const data = 'Message to authenticate';
const key1 = 'secret-key-1';
const key2 = 'secret-key-2';

// Plain SHA-256 hash (no key)
function createHash(data) {
  const hash = crypto.createHash('sha256');
  hash.update(data);
  return hash.digest('hex');
}

// HMAC-SHA-256 (with key)
function createHmac(data, key) {
  const hmac = crypto.createHmac('sha256', key);
  hmac.update(data);
  return hmac.digest('hex');
}

// Compare results
console.log(`Data: "${data}"`);
console.log('\nPlain SHA-256 (no key):');
console.log(createHash(data));

console.log('\nHMAC-SHA-256 with key1:');
console.log(createHmac(data, key1));

console.log('\nHMAC-SHA-256 with key2:');
console.log(createHmac(data, key2));

// Demonstrate hash extension attack vulnerability
// This is a simplified illustration - actual extension attacks are more complex
console.log('\nHash Extension Attack Vulnerability:');

const originalData = 'original-message';
const originalHash = createHash(originalData);
console.log(`Original data: "${originalData}"`);
console.log(`Original SHA-256: ${originalHash}`);

// Attacker doesn't know the original data, but knows its hash
// and wants to append malicious data
const appendedData = 'malicious-appendage';
const combinedData = `${originalData}${appendedData}`;
const combinedHash = createHash(combinedData);
console.log(`Appended data: "${appendedData}"`);
console.log(`Combined data: "${combinedData}"`);
console.log(`Combined SHA-256: ${combinedHash}`);
console.log('With plain hash, an attacker who knows the hash of original data can compute valid hash for combined data without knowing the original data');

// HMAC is not vulnerable to extension attacks
console.log('\nHMAC Protection:');
const originalHmac = createHmac(originalData, key1);
const combinedHmac = createHmac(combinedData, key1);
console.log(`Original HMAC: ${originalHmac}`);
console.log(`Combined HMAC: ${combinedHmac}`);
console.log('With HMAC, an attacker cannot compute a valid HMAC for combined data without knowing the secret key');
Misolni ishga tushirish »

Xavfsizlik bo‘yicha eng yaxshi amaliyotlar

HMAC dan foydalanayotganda, ushbu xavfsizlik bo‘yicha eng yaxshi amaliyotlarni ko‘rib chiqing:

  1. Kuchli xesh algoritmlaridan foydalaning: MD5 va SHA-1dan ko‘ra SHA-256, SHA-384, SHA-512 yoki SHA-3ni afzal qiling.
  2. Kuchli, tasodifiy kalitdan foydalaning: Kalit hech bo‘lmaganda xesh chiqishiga teng bo‘lishi kerak (masalan, SHA-256 uchun 32 bayt).
  3. Kalit sirini saqlang: HMAC xavfsizligi kalitning maxfiyligiga bog‘liq.
  4. Doimiy vaqtni taqqoslashdan foydalaning: HMAC qiymatlarini tekshirishda vaqt hujumlarining oldini olish uchun crypto.timingSafeEqual() dan foydalaning.
  5. Zamonaviy kalitlarni boshqarishdan foydalaning: KeyObject API yoki sezgir kalitlar uchun kalitlarni boshqarish xizmatidan foydalanishni o‘ylab ko‘ring.
  6. HMAC maqsadini ko‘rib chiqing: HMAC maxfiylikni emas, balki ma’lumotlarning yaxlitligini va autentifikatsiyasini ta’minlaydi. Shifrlash uchun HMAC-ni shifrlash algoritmlari bilan birlashtiring.

HMAC uchun umumiy foydalanish holatlari

  • API autentifikatsiyasi: Yuboruvchining shaxsi va ma’lumotlar yaxlitligini tekshirish uchun API so‘rovlarini imzolash.
  • Xabar autentifikatsiyasi: uzatish paytida xabarlar o‘zgartirilmaganligini ta’minlash.
  • Cookie/Tokenni tekshirish: Veb-ilovalarda imzolangan cookie yoki tokenlarni yaratish va tekshirish.
  • Fayl yaxlitligini tekshirish: fayllar o‘zgartirilmagan yoki buzilmaganligini tekshirish.
  • Parolni saqlash: bcrypt kabi ixtisoslashtirilgan algoritmlarga afzallik berilsa-da, HMAC parolni xeshlash sxemasining bir qismi sifatida ishlatilishi mumkin.
  • Kalit hosilasi: HKDF kabi kalit hosila funksiyalarida komponent sifatida.
‹ OrqagaKeyingisi

W3Schools Pathfinder

Yutuqlaringizni kuzating – bu bepul!

Ro'yxatdan o'tishKirish