---
name: "libressl-HMAC"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-HMAC"
---

# libressl-HMAC(3)

HMAC message authentication code

## NAME

**HMAC**, **HMAC\_CTX\_new**, **HMAC\_CTX\_reset**, **HMAC\_CTX\_free**, **HMAC\_Init\_ex**, **HMAC\_Update**, **HMAC\_Final**, **HMAC\_CTX\_copy**, **HMAC\_CTX\_set\_flags**, **HMAC\_CTX\_get\_md**, **HMAC\_size** – HMAC message authentication code

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/hmac.h\>**

*unsigned* *char* *\**\

**HMAC**(*const EVP\_MD \*evp\_md*, *const void \*key*, *int key\_len*, *const unsigned char \*d*, *size\_t n*, *unsigned char \*md*, *unsigned int \*md\_len*);

*HMAC\_CTX* *\**\

**HMAC\_CTX\_new**(*void*);

*int*\

**HMAC\_CTX\_reset**(*HMAC\_CTX \*ctx*);

*void*\

**HMAC\_CTX\_free**(*HMAC\_CTX \*ctx*);

*int*\

**HMAC\_Init\_ex**(*HMAC\_CTX \*ctx*, *const void \*key*, *int key\_len*, *const EVP\_MD \*md*, *ENGINE \*engine*);

*int*\

**HMAC\_Update**(*HMAC\_CTX \*ctx*, *const unsigned char \*data*, *size\_t len*);

*int*\

**HMAC\_Final**(*HMAC\_CTX \*ctx*, *unsigned char \*md*, *unsigned int \*len*);

*int*\

**HMAC\_CTX\_copy**(*HMAC\_CTX \*dctx*, *HMAC\_CTX \*sctx*);

*void*\

**HMAC\_CTX\_set\_flags**(*HMAC\_CTX \*ctx*, *unsigned long flags*);

*const* *EVP\_MD* *\**\

**HMAC\_CTX\_get\_md**(*const HMAC\_CTX \*ctx*);

*size\_t*\

**HMAC\_size**(*const HMAC\_CTX \*e*);

## DESCRIPTION

HMAC is a MAC (message authentication code), i.e. a keyed hash function used for message authentication, which is based on a hash function.

**HMAC**() computes the message authentication code of the *n* bytes at *d* using the hash function *evp\_md* and the key *key* which is *key\_len* bytes long.

It places the result in *md*, which must have space for the output of the hash function, which is no more than EVP\_MAX\_MD\_SIZE bytes. The size of the output is placed in *md\_len*, unless it is NULL.

*evp\_md* can be EVP\_sha1(3), EVP\_ripemd160(3), etc.

**HMAC\_CTX\_new**() allocates and initializes a new *HMAC\_CTX* object.

**HMAC\_CTX\_reset**() zeroes and re-initializes *ctx* and associated resources, making it suitable for new computations as if it was deleted with **HMAC\_CTX\_free**() and newly created with **HMAC\_CTX\_new**().

**HMAC\_CTX\_free**() erases the key and other data from *ctx*, releases any associated resources, and finally frees *ctx* itself.

The following functions may be used if the message is not completely stored in memory:

**HMAC\_Init\_ex**() sets up or reuses *ctx* to use the hash function *evp\_md* and the key *key*. Either can be NULL, in which case the existing one is reused. The *ctx* must have been created with **HMAC\_CTX\_new**() before the first use in this function. If **HMAC\_Init\_ex**() is called with a NULL *key* but *evp\_md* is neither NULL nor the same as the previous digest used by *ctx*, then an error is returned because reuse of an existing key with a different digest is not supported. The *ENGINE*, *\*engine* argument is always ignored and passing NULL is recommended.

**HMAC\_Update**() can be called repeatedly with chunks of the message to be authenticated (*len* bytes at *data*).

**HMAC\_Final**() places the message authentication code in *md*, which must have space for the hash function output.

**HMAC\_CTX\_copy**() copies all of the internal state from *sctx* into *dctx*.

**HMAC\_CTX\_set\_flags**() applies the specified flags to the internal *EVP\_MD\_CTX* objects. Possible flag values EVP\_MD\_CTX\_FLAG\_\* are defined in ⟨openssl/evp.h⟩.

**HMAC\_size**() returns the length in bytes of the underlying hash function output. It is implemented as a macro.

## RETURN VALUES

**HMAC**() returns a pointer to the message authentication code or NULL if an error occurred.

**HMAC\_CTX\_new**() returns a pointer to the new *HMAC\_CTX* object or NULL if an error occurred.

**HMAC\_CTX\_reset**(), **HMAC\_Init\_ex**(), **HMAC\_Update**(), **HMAC\_Final**(), and **HMAC\_CTX\_copy**() return 1 for success or 0 if an error occurred.

**HMAC\_CTX\_get\_md**() returns the message digest that was previously set for *ctx* with **HMAC\_Init\_ex**(), or NULL if none was set.

**HMAC\_size**() returns the length in bytes of the underlying hash function output or 0 on error.

## SEE ALSO

CMAC\_Init(3), EVP\_DigestInit(3)

## STANDARDS

RFC 2104

## HISTORY

**HMAC**(), **HMAC\_Update**(), **HMAC\_Final**(), and **HMAC\_size**() first appeared in SSLeay 0.9.0 and have been available since OpenBSD 2.4.

**HMAC\_Init\_ex**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.

**HMAC\_CTX\_set\_flags**() first appeared in OpenSSL 0.9.7f and have been available since OpenBSD 3.8.

**HMAC\_CTX\_copy**() first appeared in OpenSSL 1.0.0 and has been available since OpenBSD 4.9.

**HMAC\_CTX\_new**(), **HMAC\_CTX\_reset**(), **HMAC\_CTX\_free**(), and **HMAC\_CTX\_get\_md**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3.

## CAVEATS

Other implementations allow *md* in **HMAC**() to be NULL and return a static array, which is not thread safe.