How can I decrypt a HMAC?

node.js cryptography hmac sha256
ThomasReggi picture ThomasReggi · Jan 8, 2013 · Viewed 76.5k times · Source

I can make an HMAC using the following:

var encrypt = crypto.createHmac("SHA256", secret).update(string).digest('base64');

I am trying to decrypt an encoded HMAC with the secret:

var decrypt = crypto.createDecipher("SHA256", secret).update(string).final("ascii");

The following was unsuccessful. How can I decrypt a HMAC with the key?

I get the following error:

node-crypto : Unknown cipher SHA256

crypto.js:155
  return (new Decipher).init(cipher, password);
                        ^
Error: DecipherInit error

Answer

CodesInChaos picture CodesInChaos · Jan 8, 2013

HMAC is a MAC/keyed hash, not a cipher. It's not designed to be decrypted. If you want to encrypt something, use a cipher, like AES, preferably in an authenticated mode like AES-GCM.

The only way to "decrypt" is guessing the whole input and then comparing the output.

Related questions

Crypto algorithm list

I'm trying to find a list of strings that can be used a a crypto algorithm to fit into this function, replacing SHA256. crypto.createHmac("SHA256", secret).update(string).digest('base64'), I've come to the understanding that crypto uses …

Read More
Node.js hashing of passwords

I am currently using the following for hashing passwords: var pass_shasum = crypto.createHash('sha256').update(req.body.password).digest('hex'); Could you please suggest improvements to make the project safer?

Read More
How to encrypt data that needs to be decrypted in node.js?

We are using bcrypt for hashing passwords and data that never needs to be decrypted. What should we do to protect other user information that does need to be decrypted? For example, let's say that we didn't want a user's …

Read More