What is HMAC ?

Hash message authentication code (HMAC) is a specific construction for calculating a message authentication code (MEC) involving a cryptographic hash function in combination with a secret cryptographic key and cryptography is a method of storing and transmitting data in a particular form so that only those for whom it is intended can read and process it say it simple encryption and decryption of text.


1.    What is MAC?

MAC stands for Massage Authentication Code. It's basically a checksum for data going though insecure channel. 

A general step-by-step process of how a generic MAC function works can be described as following:

1. Sender sends Message & MAC(Message, K), M1
2. Receiver receives both parts
3. Receiver makes his own MAC(Message, K), M2
4. If M2 != M1, data has been corrupted 
5. If M2 == M1, data is valid

A few MAC algorithms are available. DES and AES are among the most well known ones.


2.    MAC is different from MD (Message Digest).

Message Digest (MD) is like MAC in the way that it is also a kind of checksum. However, 'this checksum' is computed by a hash function that takes only the message as input, instead of the message and a shared secret key as in MAC. But MD is widely used in Public Key Infrastructure when computing the digital signatures.

3.    What is HMAC?

Hash message authentication code (HMAC) is a specific construction for calculating a message authentication code (MEC) involving a cryptographic hash function in combination with a secret cryptographic key.

Theoretically, any hash fuction could be used with HMAC, although more secure hashing functions are preferable. Commonly used hash functions are MD5 and SHA-1. As computers become more and more powerful, increasingly complex hash functions will probably be used. Furthermore, there are several generations of SHA hashing functions (SHA-256, SHA-384, and SHA-512) which are currently available but not very widely used as their added security is not yet believed to be needed in everyday transactions.

4.    How HMAC works?

HMAC generates a Message Authentication Code by the following formula:

HMAC(M) = H[(K+opad) & H[(k+ipad) & M]]

• M = Message
• H[] = Underlying Hash function
• K = Shared Secret Key
• opad = 36hex, repeated as needed
• ipad = 5Chex, repeated as needed
• & = concatenation operation
• + = XOR operation

The HMAC(M) is then sent as any typical MAC(M) in a message transaction over insecure channels (See section 1). Again, any hash function can be used, but MD5 and SHA-1 seem to be most popular.

5.    Why use HMAC?

Speed is the main reason. Hash functions are much faster than block ciphers such as DES and AES in software implementation

However, HMAC, as a cryptographic mechanism, is repudiatable.  That is, Bob cannot demonstrate that data really came from Alice -- both a sender and a receiver can generate an exactly same HMAC output (so Bob could have made the data himself). This is unlike digital signatures which only the sender can generate.


ref:- http://krytosvirus.com/text/HMAC.htm

Don’t use Delete Links because they create Security Holes

Suppose someone sends an email to you that contains an image. The image could be embedded in the message with the following tag:

<img src=”http://www.theApp.com/Home/Delete/23” _fcksavedurl=””http://www.theApp.com/Home/Delete/23”” />

Notice that the src attribute points at the Delete() method of the Home controller class. Opening the email (and allowing images in your email client) will delete record 23 without warning. This is bad. This is a security hole.

So The Preffered way to delete in MVC is :

Examine the Delete and DeleteConfirmed methods


















The HttpPost method that deletes the data is named DeleteConfirmed to give the HTTP POST method a unique signature or name.

The common language runtime (CLR) requires overloaded methods to have a unique parameter signature (same method name but different list of parameters). However, here you need two Delete methods -- one for GET and one for POST -- that both have the same parameter signature. (They both need to accept a single integer as a parameter.)

To sort this out, you can do a couple of things. One is to give the methods different names. That's what the scaffolding mechanism did in the preceding example. Add the ActionName("Delete") attribute to the DeleteConfirmed method. This effectively performs mapping for the routing system so that a URL that includes /Delete/ for a POST request will find the DeleteConfirmed method.

---------------------------------

Another common way to avoid a problem with methods that have identical names and signatures is to artificially change the signature of the POST method to include an unused parameter. For example, some developers add a parameter type FormCollection that is passed to the POST method, and then simply don't use the parameter:

---------------------That's it.. Thanks for reading my blog.------------------------

ENGOY

TPL VS Threads

To demonstrate we have two similar program one uses Threads and other Parallel. We will not deep dive into it but we will have a clear idea How Parallel and Threads works so to make programs get's faster and optimized.

Thread uses Single Core at one time.

Parallel uses Multi Core at one time.

Now let's prove this
Thread Program

Perfmon status for the above program

Parallel Program

Perfmon status for the above program

------------------------------x-x-x------------------------------

Enjoy one of my fav song. ;)

Task Parallel Library VS Async and Await

TPL - The Task Parallel Library was designed for parallel programming.
AA - Async and await are for asynchronous programming.

TPL - when you have a lot of work to do and want to split up that work among multiple threads so you can use all the CPU cores.
AA - when you have an operation (or many operations) that will complete in the future, and you want to do other things in the meantime.

TPL - Best suited for CPU-intensive work.
AA - Best suited for I/O-bound work.

There is some overlap. For example, you can treat a parallel computation as an asynchronous operation so it doesn't tie up your UI thread. Also, both the TPL and async/await make use of the Task type, though they use it in very different ways.

Teaching HTML New Tricks

OVERVIEW

AngularJS directives are what controls the rendering of the HTML inside an AngularJS application.   This is what AngularJS refers to as "teaching HTML new tricks".

Directive Types

You can implement the following types of directives:

• "E" Element directives
• "A" Attribute directives
• "C" CSS class directives
• Comment directives

The template and templateUrl Properties

You can put that HTML inside the template attribute of the directive definition object.  But in case that HTML template grows big, it is gets hard to write and maintain the HTML inside a JavaScript string. You can then put the HTML into its own file and have AngularJS load it from that file. You do so by putting the URL of the HTML template file into the templateUrl property of the directive definition object. Here is an example:

Isolating Scope in Directive.

To be able to bind the two elements to different values in the $scope object, you need to bind the HTML template to an isolate scope.

compile() and link() Functions

The compile() and link() functions define how the directive is to modify the HTML that matched the directive.
When the directive is first compiled by AngularJS (first found in the HTML), the compile() function is called. The compile() function can then do any one-time configuration of the element needed.
The compile() function finishes by returning the link() function. The link() function is called every time the element is to be bound to data in the $scope object.

Setting Only a link() Function

Sometimes you do not need the compile() step for your directive. You only need th link() function. In that case you can set the link() function directly on the directive definition object.

Directives Which Wraps Elements Via Transclusion

<mytransclude>This is a transcluded directive {{firstName}}</mytransclude>

The directive is marked by the element. But the content inside it is set by the developer. Thus, this part of the HTML should not be replaced by the directive's HTML template. We actually want that part of the HTML to be processed by AngularJS. This processing is called "transclusion".
In order to make AngularJS process the HTML inside a directive, you have to set the transclude property of the directive definition object to true.