Forum Discussion

gpoverland's avatar
gpoverland
Icon for Nimbostratus rankNimbostratus
Feb 03, 2016

F5 iRule Example integrating HMAC

I currently utilize a static key value to create a custom encrypted cookie to validate user session authenticity via cookie values. I would like to move over to using an HMAC solution, but having iss...
iRules
LTM
security
gpoverland's avatar
gpoverland
Icon for Nimbostratus rankNimbostratus
Feb 04, 2016

Kevin,, I see how to create the HMAC using the 10.2 version of the HMAC iRULE, but I don't see how to sign or verify. That was the piece I was missing. Basically, I am going to set two pieces of information set when HTTP Request as my message and sign them using the HMAC (one piece of info from an application session cookie and the other from X509 Subject field from client presented cert). I'd like to verify the hash each time a request comes in to validate the user and the session. It looks pretty easy in 11.1 (or later), but I don't see many examples using 10.2 code..Thoughts?

 

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 04, 2016
    Hi dtwesten, HMAC is basically a hash-function with added symmetric encryption (unlike digital signatures which are based on asymmetric keys). The use cases of HMAC are to identify that the sender and receiver are owning the same SharedKey (Authentication) and/or that message are not tampered on transit (Message Signing). To give you an idea what would be needed to create an HMAC-enabled solution... 1. Both parties had somehow exchanged the SharedKey in advance. 2. The Sender has PlainText (e.g. your Cookie+SSL SID) for the receiver that needs to be protected from tampering 3. The Sender computes HMAC(PlainText&SharedKey) 4. The Sender sends the PlainText in addition with the result of HMAC(PlainText&SharedKey) 5. The Receiver splits the received data into PlainText and the result of HMAC(PlainText&SharedKey). 6. The Receiver computes HMAC(PlainText&SharedKey) again. 7. The Receiver compares his computed HMAC(PlainText&SharedKey) results with the received HMAC(PlainText&SharedKey) results. 8. If both HMAC codes are identical, then the Receiver can be sure that the Sender is the origin of the received message and nothing was tampered on transit. Note: I don’t take replay attacks into consideration ;-) To integrate HMAC in your homegrown security solution, you don’t have to follow any specifications in which format the message and code is exchanged between the two parties unless you need certain interoperability. Do you? Cheers, Kai