About SHA-256 source code

But I am looking for a code that include secret key too.

Did you google the term? How many people freely publish their secrets? An open secret sounds like a classic example of an oxymoron.

I mean I need a code that gets a secret from the user and uses it to Hash a data.

If you need code to load some secret from a user then you will obviously need to write that code.

There is no SHA-256 code that will contain any code to ask for secrets. SHA-256 is a hash function. All it will do is compute a hash function based on the input data _you_ supply.

Your request is like: "I want a C code implementation of 'plus'. But 'plus' needs to request the two numbers it is going to add together."

This is an embedded forum. Embedded hardware are not like a PC. There are no standard "keyboard" or "display" connected. So the developer - you - needs to create the magic glue that interfaces with your specific hardware to detect outside stimuli or produce output feedback.

I mean the argument in the SHA function would get a parameter called secret. Maybe some one has written such a code because I see in the web that some online converters also get secret key and a data to complete the conversion so the result of the SHA is depending on the secret key. This is the way I need to verify that the user knows the secret key before authentication:
device sends a random number to the user and the user Hash(SHA-256) this number with the secret key and sends back to the device. Since the device knows the secret key so that the Hashed value will in the device and the returned back from the user must be the same.

You just concatenate multiple data to the hash function. Nothing fancy at all.

Haven't you spent some time actually thinking about how things could be implemented? Own thinking is mandatory when doing projects.

Thanks.
So as I understand, the standard way to use secret key is to concatenate secret and data and give it to Hash function as data argument. I say standard because the other side may be a Hand held unit made by another company trying to read the device.

You know the value 15.

I send you the challenge 47.

You respond with 15+47 = 62.

The only way you could have responded with 62 is if you knew the secret value 15.

That's the basic function of a challenge/response cycle.

Obviously, "+" is bad. Because a listener can do the inverse and compute 62-47 to figure out that the secret must be 15.

So "+" gets replaced with a cryptographically strong hash function.

And 15 and 47 gets replaced with tokens that are long and complicated enough that an attacker can't try a huge number of "random" tokens (dictionary attacks or sequencing of all possible tokens up to a specific length) just to try to get the same result.

But you should already know this, because you should already have spent time reading up on the concept following a couple of Google hits. If you don't read until you understand, you will fail badly.

And you can't claim that there aren't lots of good information available. Everything you will ever need to know about the subject is well indexed by Google. And described in a good way that is easy to read. So how about you start doing some own work. If you are a professional, you get your salary for doing work. If you are a student you are expected to study. Right now, you would be a bad student and/or a bad employee.

Thank you. Your description is good for understanding basic concept of Hash. But I still need to know a standard way of adding a key to a data maybe like method used in HMAC-SHA-256.

What part of the use of Google is it that you don't understand?

Right now, you are a danger to yourself and your surroundings because you are refusing to invest time trying to understand exactly what you should do - and how you should do it.

Hi Hamed Adldoost,

Could you please describe the method used in HMAC-SHA-256? Since you already know that.

You know the method, but you want a more standard method. If this is the case, you would have to describe the method first.