---

2.3.4 HMAC Digests

The fwknop project employs an HMAC in the encrypt-then-authenticate model for strong SPA message authentication. The HMAC itself is derived from a digest of the encrypted SPA message along with a dedicated HMAC key.

Currently, libfko supports the same message digests as mentioned in the Digest section above, and these are (in order of strength):

Variable: int fko_digest_type_t ¶

FKO_HMAC_MD5

FKO_HMAC_SHA1

FKO_HMAC_SHA256 (libfko default)

FKO_HMAC_SHA384

FKO_HMAC_SHA512

As indicated in the list above, SHA256 is the default. This means the HMAC digest type does not need to be explicitly set unless you wish to use one of the other values. This applies to all libfko SPA data fields that have a default value.