Hashes, HMAC and Key Derivation: SHA-2, SHA-3, HMAC, HKDF and When to Use Which
To prove a message came from someone holding the key you use HMAC, not SHA256(secret + message), because SHA-2 is open to length extension; keys are derived per purpose from a single master key with HKDF. We cover a hash's three guarantees, choosing SHA-2 or SHA-3, verifying Bookstore's payment webhook with HMAC, a timestamp window, FixedTimeEquals and secret rotation, HKDF, Argon2id options and encoding pitfalls, with real outputs.
14 Nov 2026
·
14 min
·
2
