What is HMAC ?

Hash message authentication code (HMAC) is a specific construction for calculating a message authentication code (MEC) involving a cryptographic hash function in combination with a secret cryptographic key and cryptography is a method of storing and transmitting data in a particular form so that only those for whom it is intended can read and process it say it simple encryption and decryption of text.


1.    What is MAC?

MAC stands for Massage Authentication Code. It's basically a checksum for data going though insecure channel. 

A general step-by-step process of how a generic MAC function works can be described as following:

1. Sender sends Message & MAC(Message, K), M1
2. Receiver receives both parts
3. Receiver makes his own MAC(Message, K), M2
4. If M2 != M1, data has been corrupted 
5. If M2 == M1, data is valid

A few MAC algorithms are available. DES and AES are among the most well known ones.


2.    MAC is different from MD (Message Digest).

Message Digest (MD) is like MAC in the way that it is also a kind of checksum. However, 'this checksum' is computed by a hash function that takes only the message as input, instead of the message and a shared secret key as in MAC. But MD is widely used in Public Key Infrastructure when computing the digital signatures.

3.    What is HMAC?

Hash message authentication code (HMAC) is a specific construction for calculating a message authentication code (MEC) involving a cryptographic hash function in combination with a secret cryptographic key.

Theoretically, any hash fuction could be used with HMAC, although more secure hashing functions are preferable. Commonly used hash functions are MD5 and SHA-1. As computers become more and more powerful, increasingly complex hash functions will probably be used. Furthermore, there are several generations of SHA hashing functions (SHA-256, SHA-384, and SHA-512) which are currently available but not very widely used as their added security is not yet believed to be needed in everyday transactions.

4.    How HMAC works?

HMAC generates a Message Authentication Code by the following formula:

HMAC(M) = H[(K+opad) & H[(k+ipad) & M]]

• M = Message
• H[] = Underlying Hash function
• K = Shared Secret Key
• opad = 36hex, repeated as needed
• ipad = 5Chex, repeated as needed
• & = concatenation operation
• + = XOR operation

The HMAC(M) is then sent as any typical MAC(M) in a message transaction over insecure channels (See section 1). Again, any hash function can be used, but MD5 and SHA-1 seem to be most popular.

5.    Why use HMAC?

Speed is the main reason. Hash functions are much faster than block ciphers such as DES and AES in software implementation

However, HMAC, as a cryptographic mechanism, is repudiatable.  That is, Bob cannot demonstrate that data really came from Alice -- both a sender and a receiver can generate an exactly same HMAC output (so Bob could have made the data himself). This is unlike digital signatures which only the sender can generate.


ref:- http://krytosvirus.com/text/HMAC.htm

Don’t use Delete Links because they create Security Holes

Suppose someone sends an email to you that contains an image. The image could be embedded in the message with the following tag:

<img src=”http://www.theApp.com/Home/Delete/23” _fcksavedurl=””http://www.theApp.com/Home/Delete/23”” />

Notice that the src attribute points at the Delete() method of the Home controller class. Opening the email (and allowing images in your email client) will delete record 23 without warning. This is bad. This is a security hole.

So The Preffered way to delete in MVC is :

Examine the Delete and DeleteConfirmed methods


















The HttpPost method that deletes the data is named DeleteConfirmed to give the HTTP POST method a unique signature or name.

The common language runtime (CLR) requires overloaded methods to have a unique parameter signature (same method name but different list of parameters). However, here you need two Delete methods -- one for GET and one for POST -- that both have the same parameter signature. (They both need to accept a single integer as a parameter.)

To sort this out, you can do a couple of things. One is to give the methods different names. That's what the scaffolding mechanism did in the preceding example. Add the ActionName("Delete") attribute to the DeleteConfirmed method. This effectively performs mapping for the routing system so that a URL that includes /Delete/ for a POST request will find the DeleteConfirmed method.

---------------------------------

Another common way to avoid a problem with methods that have identical names and signatures is to artificially change the signature of the POST method to include an unused parameter. For example, some developers add a parameter type FormCollection that is passed to the POST method, and then simply don't use the parameter:

---------------------That's it.. Thanks for reading my blog.------------------------

ENGOY

TPL VS Threads

To demonstrate we have two similar program one uses Threads and other Parallel. We will not deep dive into it but we will have a clear idea How Parallel and Threads works so to make programs get's faster and optimized.

Thread uses Single Core at one time.

Parallel uses Multi Core at one time.

Now let's prove this
Thread Program

Perfmon status for the above program

Parallel Program

Perfmon status for the above program

------------------------------x-x-x------------------------------

Enjoy one of my fav song. ;)

Task Parallel Library VS Async and Await

TPL - The Task Parallel Library was designed for parallel programming.
AA - Async and await are for asynchronous programming.

TPL - when you have a lot of work to do and want to split up that work among multiple threads so you can use all the CPU cores.
AA - when you have an operation (or many operations) that will complete in the future, and you want to do other things in the meantime.

TPL - Best suited for CPU-intensive work.
AA - Best suited for I/O-bound work.

There is some overlap. For example, you can treat a parallel computation as an asynchronous operation so it doesn't tie up your UI thread. Also, both the TPL and async/await make use of the Task type, though they use it in very different ways.