0
  • I have a text file with stuff in it
  • I want to checksum it and create a hash for later use to know if the file has changed, when used anywhere else
  • which to use? sha256sum myfile or sha256hmac myfile
1

sha256mac is to be used with a key.

sha512hmac - compute and check HMAC values

sha512hmac [-u | -k keyfile | -K key] file

-k filename:

Use the contents of the specified file as the secret key used in computing the HMAC values. If no key file or text is specified, a hard-coded default value is used. This option should always be used.

Executing sha256hmac myfile.txt will (a) give a different hash than sha256sum, and more importantly, (b) on a given system, without providing a key via the -K option, it will use some hard-coded system value that is unlikely to be the same on any other system. Thus, executing sha256hmac myfile.txt without specifying a key, the output will be different on different computers; so I think the only reason to use sha256hmac without a key is if you want to try and guarantee something can only work or be verified on the computer the hmac hash was generated on {I'm assuming one cannot easily find or get this hard-coded key}.

Simply using sha256sum myfile.txt will produce the same hash on any computer system for a given file.

  • I actually just tested that theory now: "I think the only reason to use sha256hmac without a key is if you want to try and guarantee something can only work or be verified on the computer the hmac hash was generated on" -- I sha256hmac'd the same file on three machines (fedora 30, fedora 31 and fedora 31), and I got back three times the same HMAC. So it seems to me that generating a value with the 'default' key is basically pointless. Well, in the text you pasted it's written "This option should always be used"... – Emmanuel Touzery Mar 20 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.