do I use sha256sum or sha256hmac for file checksum

Question

• I have a text file with stuff in it
• I want to checksum it and create a hash for later use to know if the file has changed, when used anywhere else
• which to use? sha256sum myfile or sha256hmac myfile

Answer 1

sha256mac is to be used with a key.

sha512hmac - compute and check HMAC values

sha512hmac [-u | -k keyfile | -K key] file

-k filename:

Use the contents of the specified file as the secret key used in computing the HMAC values. If no key file or text is specified, a hard-coded default value is used. This option should always be used.

Executing sha256hmac myfile.txt will (a) give a different hash than sha256sum, and more importantly, (b) on a given system, without providing a key via the -K option, it will use some hard-coded system value that is unlikely to be the same on any other system. Thus, executing sha256hmac myfile.txt without specifying a key, the output will be different on different computers; so I think the only reason to use sha256hmac without a key is if you want to try and guarantee something can only work or be verified on the computer the hmac hash was generated on {I'm assuming one cannot easily find or get this hard-coded key}.

Simply using sha256sum myfile.txt will produce the same hash on any computer system for a given file.