I'd like to compute a HMAC-SHA512 digest in my bash script. So far I've found only this repeated many times over many different sites.
echo -n message | openssl dgst -sha256 -hmac secret -binary >message.mac
Apparently no one posting this realizes this is not the proper way to pass a secret string to a program as the secret will be visible in the process list for every other process running on the system. Is there any other way (perhaps with other tool) to easily make an HMAC in the shell with better interface for passing secrets?
I use the following tool (
~/bin/hmac) now. It takes the key from the
MACKEY environment variable.
#!/usr/bin/env python3 import hmac, sys, os key = os.environ['MACKEY'].encode('utf-8') algo = os.getenv('MACALGO', 'sha512') digest = hmac.new(key, digestmod = algo) while True: buf = sys.stdin.buffer.read(512) if not buf: break digest.update(buf) print(digest.hexdigest())
echo -n message | MACKEY=foobar hmac