{"id":2401,"date":"2026-09-06T23:27:39","date_gmt":"2026-09-06T23:27:39","guid":{"rendered":"https:\/\/wayhope.kro.kr\/?p=2401"},"modified":"2026-09-08T02:42:16","modified_gmt":"2026-09-08T02:42:16","slug":"hmac-%ed%8c%a8%ed%82%b7-%eb%b3%b4%ec%95%88-%ed%95%b5%ec%8b%ac-%ec%a0%95%eb%a6%ac","status":"publish","type":"post","link":"https:\/\/wayhope.kro.kr\/?p=2401","title":{"rendered":"HMAC \ud328\ud0b7 \ubcf4\uc548 \ud575\uc2ec \uc815\ub9ac"},"content":{"rendered":"\n

HMAC(Hash-based Message Authentication Code)\uc740 \ud328\ud0b7\uc758 \uc704\ubcc0\uc870 \uc5ec\ubd80\uc640 \uc1a1\uc2e0\uc790\uc758 \uc778\uc99d\uc744 \uac80\uc99d\ud558\uae30 \uc704\ud55c \uba54\uc2dc\uc9c0 \uc778\uc99d \ubc29\uc2dd<\/strong>\uc774\ub2e4.<\/p>\n\n\n\n

\uac8c\uc784 \uc11c\ubc84\uc640 \ud074\ub77c\uc774\uc5b8\ud2b8\uac00 \ud1b5\uc2e0\ud560 \ub54c \ud328\ud0b7 \uc790\uccb4\ub97c \uc554\ud638\ud654\ud558\uc9c0 \uc54a\ub354\ub77c\ub3c4, HMAC\uc744 \uc0ac\uc6a9\ud558\uba74 \uacf5\uaca9\uc790\uac00 \ud328\ud0b7 \ub0b4\uc6a9\uc744 \uc784\uc758\ub85c \uc218\uc815\ud588\ub294\uc9c0 \uac80\uc99d\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n

\n\n\n\n

HMAC\uc774 \ud544\uc694\ud55c \uc774\uc720<\/h2>\n\n\n\n

\ub124\ud2b8\uc6cc\ud06c \ud328\ud0b7\uc740 \uc804\uc1a1 \uacfc\uc815\uc5d0\uc11c \uacf5\uaca9\uc790\uc5d0\uac8c \ub178\ucd9c\ub418\uac70\ub098 \ubcc0\uc870\ub420 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n

\uc608\ub97c \ub4e4\uc5b4 \uac8c\uc784\uc5d0\uc11c \ub2e4\uc74c\uacfc \uac19\uc740 \ud328\ud0b7\uc744 \ubcf4\ub0b8\ub2e4\uace0 \ud558\uc790.<\/p>\n\n\n\n

USER_ID=1001\nITEM_ID=500\nAMOUNT=100<\/code><\/pre>\n\n\n\n
\uacf5\uaca9\uc790\uac00 \ud328\ud0b7\uc744 \uac00\ub85c\ucc44\uc11c<\/p>\n\n\n\n
USER_ID=1001\nITEM_ID=500\nAMOUNT=999999<\/code><\/pre>\n\n\n\n
\ub85c \ubcc0\uacbd\ud558\uba74 \uc11c\ubc84\uac00 \uc774\ub97c \uadf8\ub300\ub85c \ucc98\ub9ac\ud560 \uc704\ud5d8\uc774 \uc788\ub2e4.<\/p>\n\n\n\n
\ub2e8\uc21c\ud788 \ud328\ud0b7 \uad6c\uc870\ub098 \ub370\uc774\ud130 \ud0c0\uc785\uc744 \uac80\uc99d\ud558\ub294 \uac83\ub9cc\uc73c\ub85c\ub294 \ud328\ud0b7\uc744 \ub204\uac00 \ub9cc\ub4e4\uc5c8\ub294\uc9c0<\/strong>\ub97c \uac80\uc99d\ud560 \uc218 \uc5c6\ub2e4.<\/p>\n\n\n\n
HMAC\uc740 \uc774 \ubb38\uc81c\ub97c \ud574\uacb0\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
HMAC\uc758 \uae30\ubcf8 \uad6c\uc870<\/h2>\n\n\n\n
HMAC\uc740 \ube44\ubc00 \ud0a4\uc640 \uba54\uc2dc\uc9c0\ub97c \uc774\uc6a9\ud574\uc11c \uc778\uc99d\uac12\uc744 \uc0dd\uc131\ud55c\ub2e4.<\/p>\n\n\n\n
HMAC = HMAC(HashAlgorithm, SecretKey, Message)<\/code><\/pre>\n\n\n\n
\uc608\ub97c \ub4e4\uc5b4 SHA-256\uc744 \uc0ac\uc6a9\ud558\uba74 \ub2e4\uc74c\uacfc \uac19\uc774 \uad6c\uc131\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
HMAC-SHA256(SecretKey, PacketData)<\/code><\/pre>\n\n\n\n
\ud074\ub77c\uc774\uc5b8\ud2b8\uc640 \uc11c\ubc84\uac00 \ub3d9\uc77c\ud55c \ube44\ubc00 \ud0a4\ub97c \uac00\uc9c0\uace0 \uc788\ub2e4\uace0 \uac00\uc815\ud55c\ub2e4.<\/p>\n\n\n\n
Client -> Packet + HMAC\nServer -> HMAC \uac80\uc99d -> Packet \ucc98\ub9ac<\/code><\/pre>\n\n\n\n
\uc11c\ubc84\ub294 \uc804\ub2ec\ubc1b\uc740 PacketData\uc640 \uc790\uc2e0\uc774 \uac00\uc9c0\uace0 \uc788\ub294 SecretKey\ub85c HMAC\uc744 \ub2e4\uc2dc \uacc4\uc0b0\ud55c\ub2e4.<\/p>\n\n\n\n
Received HMAC == Calculated HMAC<\/code><\/pre>\n\n\n\n
\uc774\uba74 \ud328\ud0b7\uc774 \uac80\uc99d\ub41c \uac83\uc73c\ub85c \ud310\ub2e8\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ud328\ud0b7 \uad6c\uc870<\/h2>\n\n\n\n
\uc77c\ubc18\uc801\uc73c\ub85c \ub2e4\uc74c\uacfc \uac19\uc740 \ud615\ud0dc\ub85c \uad6c\uc131\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
[Header][Payload][HMAC]<\/code><\/pre>\n\n\n\n
\uc608\ub97c \ub4e4\uc5b4:<\/p>\n\n\n\n
Header\nCommand = Move\n\nPayload\nUserID = 1001\nPosition = (10, 20, 30)\n\nHMAC\n9F8A...<\/code><\/pre>\n\n\n\n
\uc11c\ubc84\ub294 HMAC\uc744 \uacc4\uc0b0\ud560 \ub54c \uc77c\ubc18\uc801\uc73c\ub85c \uc778\uc99d\ud574\uc57c \ud558\ub294 \ub370\uc774\ud130 \uc804\uccb4\ub97c \ub300\uc0c1\uc73c\ub85c \ud55c\ub2e4.<\/p>\n\n\n\n
Message = Header + Payload\nHMAC = HMAC-SHA256(SecretKey, Message)<\/code><\/pre>\n\n\n\n
\n\n\n\n
\ud328\ud0b7 \uac80\uc99d \uacfc\uc815<\/h2>\n\n\n\n
\uc11c\ubc84\uac00 \ud328\ud0b7\uc744 \uc218\uc2e0\ud558\uba74 \ub2e4\uc74c\uacfc \uac19\uc740 \uc21c\uc11c\ub85c \ucc98\ub9ac\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
Receive Packet -> Parse Header -> Extract Payload\/HMAC -> Recalculate HMAC -> Compare -> Process<\/code><\/pre>\n\n\n\n
\uc608\ub97c \ub4e4\uc5b4 \uacf5\uaca9\uc790\uac00 Payload\ub97c \ubcc0\uacbd\ud558\uba74:<\/p>\n\n\n\n
Original Payload -> HMAC \uc0dd\uc131\nModified Payload -> \uae30\uc874 HMAC\uacfc \ubd88\uc77c\uce58<\/code><\/pre>\n\n\n\n
\uc11c\ubc84\uc5d0\uc11c \uac80\uc99d\uc5d0 \uc2e4\ud328\ud55c\ub2e4.<\/p>\n\n\n\n
Received HMAC != Calculated HMAC<\/code><\/pre>\n\n\n\n
\ub530\ub77c\uc11c \ud574\ub2f9 \ud328\ud0b7\uc744 \ud3d0\uae30\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
HMAC\uc740 \uc554\ud638\ud654\uac00 \uc544\ub2c8\ub2e4<\/h2>\n\n\n\n
\uac00\uc7a5 \uc911\uc694\ud55c \ubd80\ubd84\uc774\ub2e4.<\/p>\n\n\n\n
HMAC\uc740 \ub370\uc774\ud130\ub97c \uc228\uae30\ub294 \uae30\uc220\uc774 \uc544\ub2c8\ub2e4.<\/strong><\/p>\n\n\n\n
Encryption -> Confidentiality\nHMAC -> Integrity + Authentication<\/code><\/pre>\n\n\n\n
HMAC\uc744 \uc0ac\uc6a9\ud574\ub3c4 \uacf5\uaca9\uc790\ub294 \ud328\ud0b7\uc758 \ub0b4\uc6a9\uc744 \ubcfc \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\uc608\ub97c \ub4e4\uc5b4:<\/p>\n\n\n\n
USER_ID=1001\nAMOUNT=100\nHMAC=...<\/code><\/pre>\n\n\n\n
\uc774\ub77c\ub294 \ud328\ud0b7\uc744 \uc804\uc1a1\ud55c\ub2e4\uace0 \ud574\ub3c4 \uc554\ud638\ud654\ud558\uc9c0 \uc54a\uc558\ub2e4\uba74 \ub0b4\uc6a9 \uc790\uccb4\ub294 \ub178\ucd9c\ub420 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
HMAC\uc774 \ubcf4\uc7a5\ud558\ub294 \uac83\uc740 \ub2e4\uc74c\uc5d0 \uac00\uae5d\ub2e4.<\/p>\n\n\n\n
\"\uc774 \ub370\uc774\ud130\uac00 \ube44\ubc00 \ud0a4\ub97c \uac00\uc9c4 \uc8fc\uccb4\uc5d0 \uc758\ud574 \uc0dd\uc131\ub418\uc5c8\ub294\uac00?\"\n\"\uc804\uc1a1 \uacfc\uc815\uc5d0\uc11c \ub370\uc774\ud130\uac00 \ubcc0\uacbd\ub418\uc9c0 \uc54a\uc558\ub294\uac00?\"<\/code><\/pre>\n\n\n\n
\ub0b4\uc6a9\uc744 \uc228\uaca8\uc57c \ud55c\ub2e4\uba74 TLS \ub610\ub294 \ubcc4\ub3c4\uc758 \uc554\ud638\ud654 \uacc4\uce35\uc774 \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
Hash\uc640 HMAC\uc758 \ucc28\uc774<\/h2>\n\n\n\n
\ub2e8\uc21c Hash\uc640 HMAC\uc744 \ud63c\ub3d9\ud558\uba74 \uc548 \ub41c\ub2e4.<\/p>\n\n\n\n
\uc77c\ubc18\uc801\uc778 Hash\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n
Hash(Message)<\/code><\/pre>\n\n\n\n
HMAC\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n
HMAC(SecretKey, Message)<\/code><\/pre>\n\n\n\n
\uacf5\uaca9\uc790\uac00 \ub2e4\uc74c\uacfc \uac19\uc774 \ud328\ud0b7\uc744 \ubcc0\uacbd\ud588\ub2e4\uace0 \ud558\uc790.<\/p>\n\n\n\n
Message -> ModifiedMessage<\/code><\/pre>\n\n\n\n
\ub2e8\uc21c Hash\ub77c\uba74 \uacf5\uaca9\uc790\ub294 \uc0c8\ub85c\uc6b4 Hash\ub3c4 \uacc4\uc0b0\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
Hash(ModifiedMessage)<\/code><\/pre>\n\n\n\n
\ub530\ub77c\uc11c Hash\ub9cc\uc73c\ub85c\ub294 \uacf5\uaca9\uc790\ub97c \ub9c9\uc744 \uc218 \uc5c6\ub2e4.<\/p>\n\n\n\n
\ubc18\uba74 HMAC\uc740 SecretKey\uac00 \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n
HMAC(SecretKey, ModifiedMessage)<\/code><\/pre>\n\n\n\n
\uacf5\uaca9\uc790\uac00 SecretKey\ub97c \ubaa8\ub974\uba74 \uc62c\ubc14\ub978 \uc778\uc99d\uac12\uc744 \uc0dd\uc131\ud558\uae30 \uc5b4\ub835\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
HMAC\uacfc \ub514\uc9c0\ud138 \uc11c\uba85\uc758 \ucc28\uc774<\/h2>\n\n\n\n
HMAC\uacfc \ub514\uc9c0\ud138 \uc11c\uba85\uc740 \ubaa8\ub450 \ubb34\uacb0\uc131\uacfc \uc778\uc99d\uc5d0 \uc0ac\uc6a9\ud560 \uc218 \uc788\uc9c0\ub9cc \uad6c\uc870\uac00 \ub2e4\ub974\ub2e4.<\/p>\n\n\n\n
\uad6c\ubd84<\/th>HMAC<\/th>\ub514\uc9c0\ud138 \uc11c\uba85<\/th><\/tr><\/thead>
\ubc29\uc2dd<\/td>\ub300\uce6d \ud0a4<\/td>\ube44\ub300\uce6d \ud0a4<\/td><\/tr>
\ud0a4<\/td>\ub3d9\uc77c\ud55c Secret Key<\/td>Private\/Public Key<\/td><\/tr>
\uc0dd\uc131<\/td>Secret Key<\/td>Private Key<\/td><\/tr>
\uac80\uc99d<\/td>Secret Key<\/td>Public Key<\/td><\/tr>
\uc131\ub2a5<\/td>\ube60\ub984<\/td>\uc0c1\ub300\uc801\uc73c\ub85c \ub290\ub9bc<\/td><\/tr>
\uc8fc\uc694 \uc6a9\ub3c4<\/td>\uc11c\ubc84-\ud074\ub77c\uc774\uc5b8\ud2b8 \uc778\uc99d<\/td>\uacf5\uac1c \uac80\uc99d\uc774 \ud544\uc694\ud55c \uc778\uc99d<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\uac8c\uc784 \uc11c\ubc84\ucc98\ub7fc \uc11c\ubc84\uc640 \ud074\ub77c\uc774\uc5b8\ud2b8 \uc0ac\uc774\uc758 \ud1b5\uc2e0 \uc778\uc99d<\/strong>\uc774 \ubaa9\uc801\uc774\ub77c\uba74 HMAC\uc774 \ube44\uad50\uc801 \ub2e8\uc21c\ud558\uace0 \ube60\ub974\ub2e4.<\/p>\n\n\n\n
\ub2e4\ub9cc \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0 SecretKey\ub97c \ub123\ub294 \uc21c\uac04 \uc911\uc694\ud55c \ubb38\uc81c\uac00 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0 SecretKey\ub97c \ub123\uc73c\uba74 \uc548\uc804\ud55c\uac00<\/h2>\n\n\n\n
PC \uac8c\uc784\uc774\ub098 Unity \uac8c\uc784\uc5d0\uc11c\ub294 \ud2b9\ud788 \uc911\uc694\ud558\ub2e4.<\/p>\n\n\n\n
\ud074\ub77c\uc774\uc5b8\ud2b8\ub294 \uacf5\uaca9\uc790\uc758 \ud658\uacbd\uc5d0\uc11c \uc2e4\ud589\ub420 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c \ub2e4\uc74c\uacfc \uac19\uc740 \uad6c\uc870\ub294 \uadfc\ubcf8\uc801\uc73c\ub85c \ucde8\uc57d\ud558\ub2e4.<\/p>\n\n\n\n
Unity Client\n    SecretKey = \"ABC123...\"<\/code><\/pre>\n\n\n\n
\uacf5\uaca9\uc790\ub294 \ud074\ub77c\uc774\uc5b8\ud2b8 \ubc14\uc774\ub108\ub9ac\ub97c \ubd84\uc11d\ud558\uac70\ub098 \uba54\ubaa8\ub9ac\ub97c \ud655\uc778\ud574\uc11c SecretKey\ub97c \ucd94\ucd9c\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
SecretKey\uac00 \ub178\ucd9c\ub418\uba74 \uacf5\uaca9\uc790\ub294 \uc815\uc0c1 \ud074\ub77c\uc774\uc5b8\ud2b8\uc640 \ub3d9\uc77c\ud55c HMAC\uc744 \uc0dd\uc131\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
Attacker\n    -> Extract SecretKey\n    -> Modify Packet\n    -> Generate Valid HMAC\n    -> Server<\/code><\/pre>\n\n\n\n
\ub530\ub77c\uc11c HMAC\uc744 \uc0ac\uc6a9\ud588\ub2e4\uace0 \ud574\uc11c \ud074\ub77c\uc774\uc5b8\ud2b8 \uc704\ubcc0\uc870 \ubb38\uc81c\uac00 \ud574\uacb0\ub418\ub294 \uac83\uc740 \uc544\ub2c8\ub2e4.<\/strong><\/p>\n\n\n\n
\n\n\n\n
\uac8c\uc784 \uc11c\ubc84\uc5d0\uc11c\uc758 \uc62c\ubc14\ub978 \uad00\uc810<\/h2>\n\n\n\n
\uac8c\uc784\uc5d0\uc11c\ub294 \ud074\ub77c\uc774\uc5b8\ud2b8 \uc790\uccb4\ub97c \uc2e0\ub8b0\ud558\uba74 \uc548 \ub41c\ub2e4.<\/p>\n\n\n\n
HMAC\uc740 \ubcf4\uc548\uc758 \uc804\ubd80\uac00 \uc544\ub2c8\ub77c \ubc29\uc5b4 \uacc4\uce35 \uc911 \ud558\ub098<\/strong>\ub85c \ubcf4\ub294 \uac83\uc774 \uc801\uc808\ud558\ub2e4.<\/p>\n\n\n\n
\uc608\ub97c \ub4e4\uc5b4:<\/p>\n\n\n\n
Client -> Authentication -> Session Key -> HMAC Packet -> Server Validation -> Server-side Rule Validation<\/code><\/pre>\n\n\n\n
\uc11c\ubc84\uc5d0\uc11c\ub294 HMAC\ubfd0\ub9cc \uc544\ub2c8\ub77c \uc2e4\uc81c \uac8c\uc784 \uaddc\uce59\ub3c4 \uac80\uc99d\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n
\uc608\ub97c \ub4e4\uc5b4 \uc774\ub3d9 \ud328\ud0b7\uc774\ub77c\uba74:<\/p>\n\n\n\n
HMAC \uac80\uc99d\n-> Session \uac80\uc99d\n-> User \uac80\uc99d\n-> Sequence \uac80\uc99d\n-> \uc774\ub3d9 \uac70\ub9ac \uac80\uc99d\n-> \uc774\ub3d9 \uc18d\ub3c4 \uac80\uc99d\n-> Server State \uac80\uc99d\n-> \uc801\uc6a9<\/code><\/pre>\n\n\n\n
HMAC\uc774 \uc815\uc0c1\uc774\ub77c\uace0 \ud574\uc11c \uadf8 \ud589\ub3d9\uc774 \uc815\uc0c1\uc801\uc778 \ud589\ub3d9\uc774\ub77c\ub294 \uc758\ubbf8\ub294 \uc544\ub2c8\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
Replay Attack \ubb38\uc81c<\/h2>\n\n\n\n
HMAC\uc744 \ub2e8\uc21c\ud558\uac8c \uc0ac\uc6a9\ud558\uba74 Replay Attack<\/strong>\uc774 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\uc815\uc0c1\uc801\uc778 \ud328\ud0b7\uc774 \ub2e4\uc74c\uacfc \uac19\ub2e4\uace0 \ud558\uc790.<\/p>\n\n\n\n
BuyItem\nItemID = 100\nAmount = 1\nHMAC = ABCDEF...<\/code><\/pre>\n\n\n\n
\uacf5\uaca9\uc790\uac00 \uc774 \ud328\ud0b7\uc744 \uc800\uc7a5\ud588\ub2e4\uac00 \ub098\uc911\uc5d0 \uadf8\ub300\ub85c \ub2e4\uc2dc \uc804\uc1a1\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
Packet -> Server\nPacket -> Server\nPacket -> Server\nPacket -> Server<\/code><\/pre>\n\n\n\n
\ud328\ud0b7 \ub0b4\uc6a9\uc774 \ubcc0\uacbd\ub418\uc9c0 \uc54a\uc558\uae30 \ub54c\ubb38\uc5d0 HMAC \uac80\uc99d\uc740 \uacc4\uc18d \ud1b5\uacfc\ud55c\ub2e4.<\/p>\n\n\n\n
HMAC\uc740 \ud328\ud0b7\uc774 \ubcc0\uc870\ub418\uc9c0 \uc54a\uc558\ub2e4\ub294 \uc0ac\uc2e4<\/strong>\uc744 \uac80\uc99d\ud560 \ubfd0, \ucc98\uc74c \uc804\uc1a1\ub41c \ud328\ud0b7\uc778\uc9c0<\/strong>\uae4c\uc9c0 \ubcf4\uc7a5\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
Replay Attack \ubc29\uc5b4<\/h2>\n\n\n\n
\uc774\ub97c \ubc29\uc5b4\ud558\uae30 \uc704\ud574 \ud328\ud0b7\uc5d0 \ucd94\uac00\uc801\uc778 \uc0c1\ud0dc\uac12\uc744 \ub123\uc744 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\ub300\ud45c\uc801\uc73c\ub85c:<\/p>\n\n\n\n
    \n
  • Sequence Number<\/li>\n\n\n\n
  • Nonce<\/li>\n\n\n\n
  • Timestamp<\/li>\n\n\n\n
  • Request ID<\/li>\n<\/ul>\n\n\n\n
    \ub4f1\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
    \uc608\ub97c \ub4e4\uc5b4:<\/p>\n\n\n\n
    [Sequence][Command][Payload][HMAC]<\/code><\/pre>\n\n\n\n
    HMAC \ub300\uc0c1\ub3c4 Sequence\uae4c\uc9c0 \ud3ec\ud568\ud55c\ub2e4.<\/p>\n\n\n\n
    HMAC = HMAC(SecretKey, Sequence + Command + Payload)<\/code><\/pre>\n\n\n\n
    \uc11c\ubc84\ub294 \ub9c8\uc9c0\ub9c9 Sequence\ub97c \uad00\ub9ac\ud55c\ub2e4.<\/p>\n\n\n\n
    Received Sequence <= Last Sequence\n-> Reject<\/code><\/pre>\n\n\n\n
    \uc815\uc0c1\uc801\uc778 \uacbd\uc6b0:<\/p>\n\n\n\n
    100 -> 101 -> 102 -> 103<\/code><\/pre>\n\n\n\n
    \uacf5\uaca9\uc790\uac00 \uc774\uc804 \ud328\ud0b7\uc744 \ub2e4\uc2dc \ubcf4\ub0b4\uba74:<\/p>\n\n\n\n
    103 -> 101<\/code><\/pre>\n\n\n\n
    \uc11c\ubc84\uac00 \uac70\ubd80\ud55c\ub2e4.<\/p>\n\n\n\n
    \n\n\n\n
    Timestamp \ubc29\uc2dd<\/h2>\n\n\n\n
    Timestamp\ub97c \uc0ac\uc6a9\ud558\ub294 \ubc29\ubc95\ub3c4 \uc788\ub2e4.<\/p>\n\n\n\n
    Timestamp + Payload + HMAC<\/code><\/pre>\n\n\n\n
    \uc11c\ubc84\uc5d0\uc11c \ud5c8\uc6a9 \uac00\ub2a5\ud55c \uc2dc\uac04 \ubc94\uc704\ub97c \uac80\uc0ac\ud55c\ub2e4.<\/p>\n\n\n\n
    abs(ServerTime - PacketTime) <= AllowedWindow<\/code><\/pre>\n\n\n\n
    \uc608\ub97c \ub4e4\uc5b4 5\ucd08\uc758 \ud5c8\uc6a9 \ubc94\uc704\ub97c \uc124\uc815\ud55c\ub2e4\uba74 \uc624\ub798\ub41c \ud328\ud0b7\uc744 \uac70\ubd80\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
    \ub2e4\ub9cc Timestamp\ub9cc\uc73c\ub85c\ub294 \ub3d9\uc77c\ud55c \ud328\ud0b7\uc744 \uc9e7\uc740 \uc2dc\uac04 \ub3d9\uc548 \ubc18\ubcf5\ud558\ub294 \uacf5\uaca9\uc744 \uc644\uc804\ud788 \ub9c9\uc744 \uc218 \uc5c6\ub2e4.<\/p>\n\n\n\n
    \uc2e4\ubb34\uc5d0\uc11c\ub294 Nonce, Sequence Number, Request ID \ub4f1\uc758 \uc0c1\ud0dc\uac12\uc744 \ud568\uaed8 \uc0ac\uc6a9\ud558\ub294 \uac83\uc774 \ub354 \uc801\uc808\ud558\ub2e4.<\/p>\n\n\n\n
    \n\n\n\n
    HMAC \uac80\uc99d \uc2dc \uc8fc\uc758\uc810<\/h2>\n\n\n\n
    HMAC \ube44\uad50\ub294 \uac00\ub2a5\ud558\uba74 constant-time comparison<\/strong>\uc744 \uc0ac\uc6a9\ud558\ub294 \uac83\uc774 \uc88b\ub2e4.<\/p>\n\n\n\n
    \ub2e8\uc21c \ubb38\uc790\uc5f4 \ube44\uad50\ub294 \uad6c\ud604\uc5d0 \ub530\ub77c \ube44\uad50 \uc2dc\uac04\uc774 \uc785\ub825\uac12\uc5d0 \uc601\ud5a5\uc744 \ubc1b\uc744 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
    \ub530\ub77c\uc11c \ubcf4\uc548 \ub77c\uc774\ube0c\ub7ec\ub9ac\uac00 \uc81c\uacf5\ud558\ub294 \uc548\uc804\ud55c \ube44\uad50 \ud568\uc218\ub97c \uc0ac\uc6a9\ud558\ub294 \uac83\uc774 \uc88b\ub2e4.<\/p>\n\n\n\n
    \ub610\ud55c HMAC \uc54c\uace0\ub9ac\uc998\uc740 \uc9c1\uc811 \uad6c\ud604\ud558\uc9c0 \uc54a\ub294 \uac83\uc774 \uc6d0\uce59\uc774\ub2e4.<\/p>\n\n\n\n
    Bad\n-> \uc9c1\uc811 SHA-256\/HMAC \uad6c\ud604\n\nGood\n-> \uac80\uc99d\ub41c \uc554\ud638\ud654 \ub77c\uc774\ube0c\ub7ec\ub9ac \uc0ac\uc6a9<\/code><\/pre>\n\n\n\n
    \uc77c\ubc18\uc801\uc778 \uc120\ud0dd\uc9c0\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n
    HMAC-SHA-256\nHMAC-SHA-512<\/code><\/pre>\n\n\n\n
    MD5\ub098 SHA-1 \uae30\ubc18\uc758 \uc624\ub798\ub41c \uad6c\uc870\ub294 \uc2e0\uaddc \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc0ac\uc6a9\ud560 \uc774\uc720\uac00 \uac70\uc758 \uc5c6\ub2e4.<\/p>\n\n\n\n
    \n\n\n\n
    HMAC \ud0a4 \uad00\ub9ac<\/h2>\n\n\n\n
    HMAC\uc5d0\uc11c \uac00\uc7a5 \uc911\uc694\ud55c \uc790\uc0b0\uc740 \uacb0\uad6d SecretKey<\/strong>\ub2e4.<\/p>\n\n\n\n
    Algorithm Security\n        +\nSecretKey Security\n        +\nProtocol Design<\/code><\/pre>\n\n\n\n
    \ud2b9\ud788 \uc11c\ubc84 \uce21 SecretKey\ub294 \uc678\ubd80\uc5d0 \ub178\ucd9c\ub418\uc5b4\uc11c\ub294 \uc548 \ub41c\ub2e4.<\/p>\n\n\n\n
    \uc11c\ubc84 \ud658\uacbd\uc5d0\uc11c\ub294 \ud658\uacbd \ubcc0\uc218\ub098 Secret Manager \ub4f1\uc758 \ubc29\ubc95\uc73c\ub85c \uad00\ub9ac\ud558\uace0 \uc18c\uc2a4 \ucf54\ub4dc\uc5d0 \ud558\ub4dc\ucf54\ub529\ud558\uc9c0 \uc54a\ub294 \uac83\uc774 \uc88b\ub2e4.<\/p>\n\n\n\n
    Bad\nconst SECRET_KEY = \"my-secret-key\";<\/code><\/pre>\n\n\n\n
    \ubcf4\ub2e4\ub294:<\/p>\n\n\n\n
    Environment\n    HMAC_SECRET_KEY\n\nServer\n    -> Load Secret\n    -> Initialize HMAC<\/code><\/pre>\n\n\n\n
    \ud615\ud0dc\uac00 \uc801\uc808\ud558\ub2e4.<\/p>\n\n\n\n
    \n\n\n\n
    \uc2e4\uc2dc\uac04 \uac8c\uc784 \uc11c\ubc84\uc5d0\uc11c\uc758 \uc801\uc6a9<\/h2>\n\n\n\n
    \uc2e4\uc2dc\uac04 \uac8c\uc784\uc5d0\uc11c\ub294 \ubaa8\ub4e0 \ud328\ud0b7\uc5d0 \ubb34\uac70\uc6b4 \ubcf4\uc548 \ucc98\ub9ac\ub97c \uc801\uc6a9\ud558\ub294 \uac83\uc774 \ubc18\ub4dc\uc2dc \uc88b\uc740 \uac83\uc740 \uc544\ub2c8\ub2e4.<\/p>\n\n\n\n
    \uc608\ub97c \ub4e4\uc5b4 \ucd08\ub2f9 \uc218\uc2ed~\uc218\ubc31 \uac1c\uac00 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub294 \uc774\ub3d9\/\ud68c\uc804 \ud328\ud0b7\uacfc \uacb0\uc81c\/\uc544\uc774\ud15c \ud68d\ub4dd \uac19\uc740 \uc911\uc694 \ud328\ud0b7\uc740 \ubcf4\uc548 \uc694\uad6c\uc0ac\ud56d\uc774 \ub2e4\ub974\ub2e4.<\/p>\n\n\n\n
    Movement\n-> Server Authority\n-> Rate Limit\n-> State Validation\n\nInventory\n-> HMAC\n-> Sequence\n-> Server Validation\n\nPurchase\n-> Authentication\n-> HMAC\n-> Replay Protection\n-> Server-side Transaction Validation<\/code><\/pre>\n\n\n\n
    \ud2b9\ud788 \uc911\uc694\ud55c \uac83\uc740 \ud074\ub77c\uc774\uc5b8\ud2b8\uac00 \ubcf4\ub0b8 \uac12\uc744 \uadf8\ub300\ub85c \uac8c\uc784 \uc0c1\ud0dc\ub85c \ubc18\uc601\ud558\uc9c0 \uc54a\ub294 \uac83<\/strong>\uc774\ub2e4.<\/p>\n\n\n\n
    HMAC\uc740 \ub370\uc774\ud130\uc758 \uc9c4\uc704\ub97c \ubcf4\uc870\ud558\uc9c0\ub9cc \ucd5c\uc885\uc801\uc778 \uac8c\uc784 \uc0c1\ud0dc\uc758 \uad8c\ud55c\uc740 \uc11c\ubc84\uac00 \uac00\uc838\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n
    \n\n\n\n
    \uc804\uccb4\uc801\uc778 \ubcf4\uc548 \uad6c\uc870<\/h2>\n\n\n\n
    \uc2e4\uc81c \uac8c\uc784 \ub124\ud2b8\uc6cc\ud06c\uc5d0\uc11c\ub294 \ud558\ub098\uc758 \uae30\uc220\ub9cc\uc73c\ub85c \ud574\uacb0\ud558\uae30\ubcf4\ub2e4 \uacc4\uce35\uc801\uc73c\ub85c \uad6c\uc131\ud558\ub294 \uac83\uc774 \uc801\uc808\ud558\ub2e4.<\/p>\n\n\n\n
    Transport Security -> Authentication -> Session Management -> HMAC -> Replay Protection -> Rate Limit -> Server-side Validation<\/code><\/pre>\n\n\n\n
    \uac01 \uacc4\uce35\uc758 \ucc45\uc784\uc744 \ubd84\ub9ac\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n
    TLS\n-> \ud1b5\uc2e0 \uad6c\uac04 \ubcf4\ud638\n\nAuthentication\n-> \uc0ac\uc6a9\uc790 \uc778\uc99d\n\nSession\n-> \uc5f0\uacb0 \ubc0f \uc0ac\uc6a9\uc790 \uc0c1\ud0dc \uad00\ub9ac\n\nHMAC\n-> \ud328\ud0b7 \ubb34\uacb0\uc131 \ubc0f \uba54\uc2dc\uc9c0 \uc778\uc99d\n\nSequence \/ Nonce\n-> Replay Attack \ubc29\uc5b4\n\nRate Limit\n-> \uacfc\ub3c4\ud55c \uc694\uccad \uc81c\ud55c\n\nServer Validation\n-> \ube44\uc815\uc0c1 \uac8c\uc784 \ub85c\uc9c1 \ucc28\ub2e8<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \ud575\uc2ec \uc815\ub9ac<\/h2>\n\n\n\n
    HMAC\uc740 \ud328\ud0b7\uc744 \uc554\ud638\ud654\ud558\ub294 \uae30\uc220\uc774 \uc544\ub2c8\ub77c \ud328\ud0b7\uc758 \ubb34\uacb0\uc131\uacfc \uc778\uc99d\uc744 \uac80\uc99d\ud558\ub294 \uae30\uc220<\/strong>\uc774\ub2e4.<\/p>\n\n\n\n
    \ud575\uc2ec \uad6c\uc870\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n
    SecretKey + Message -> HMAC<\/code><\/pre>\n\n\n\n
    \uc11c\ubc84\uc5d0\uc11c\ub294:<\/p>\n\n\n\n
    Receive Packet -> Recalculate HMAC -> Compare -> Validate -> Process<\/code><\/pre>\n\n\n\n
    \ub2e4\ub9cc \uac8c\uc784 \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0 SecretKey\uac00 \uc874\uc7ac\ud55c\ub2e4\uba74 \ud0a4 \ud0c8\ucde8 \uac00\ub2a5\uc131\uc774 \uc788\uae30 \ub54c\ubb38\uc5d0 HMAC\ub9cc\uc73c\ub85c \ud074\ub77c\uc774\uc5b8\ud2b8\ub97c \uc2e0\ub8b0\ud560 \uc218\ub294 \uc5c6\ub2e4.<\/p>\n\n\n\n
    \uc2e4\uc81c \uac8c\uc784 \uc11c\ubc84\uc5d0\uc11c\ub294 \ub2e4\uc74c\uacfc \uac19\uc774 \uc811\uadfc\ud558\ub294 \uac83\uc774 \ud575\uc2ec\uc774\ub2e4.<\/p>\n\n\n\n
    HMAC\n+\nReplay Protection\n+\nRate Limit\n+\nServer Authority\n+\nServer-side Validation<\/code><\/pre>\n\n\n\n
    HMAC\uc740 \ud328\ud0b7\uc744 \ubbff\uac8c \ub9cc\ub4dc\ub294 \uae30\uc220\uc774 \uc544\ub2c8\ub77c, \ud328\ud0b7\uc774 \ubcc0\uc870\ub418\uc9c0 \uc54a\uc558\uc74c\uc744 \uac80\uc99d\ud558\ub294 \uae30\uc220\uc774\ub2e4. \uc11c\ubc84\uac00 \ucd5c\uc885\uc801\uc73c\ub85c \ubbff\uc5b4\uc57c \ud558\ub294 \uac83\uc740 \ud074\ub77c\uc774\uc5b8\ud2b8\uc758 \uc8fc\uc7a5 \uc790\uccb4\uac00 \uc544\ub2c8\ub77c \uc11c\ubc84\uac00 \uac80\uc99d\ud55c \uc0c1\ud0dc\ub2e4.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
    HMAC(Hash-based Message Authentication Code)\uc740 \ud328\ud0b7\uc758 \uc704\ubcc0\uc870 \uc5ec\ubd80\uc640 \uc1a1\uc2e0\uc790\uc758 \uc778\uc99d\uc744 \uac80\uc99d\ud558\uae30 \uc704\ud55c \uba54\uc2dc\uc9c0 \uc778\uc99d \ubc29\uc2dd\uc774\ub2e4. \uac8c\uc784 \uc11c\ubc84\uc640 \ud074\ub77c\uc774\uc5b8\ud2b8\uac00 \ud1b5\uc2e0\ud560 \ub54c \ud328\ud0b7 \uc790\uccb4\ub97c \uc554\ud638\ud654\ud558\uc9c0 \uc54a\ub354\ub77c\ub3c4, HMAC\uc744 \uc0ac\uc6a9\ud558\uba74 \uacf5\uaca9\uc790\uac00 \ud328\ud0b7 \ub0b4\uc6a9\uc744 \uc784\uc758\ub85c \uc218\uc815\ud588\ub294\uc9c0 \uac80\uc99d\ud560 \uc218 \uc788\ub2e4. HMAC\uc774 \ud544\uc694\ud55c \uc774\uc720 \ub124\ud2b8\uc6cc\ud06c \ud328\ud0b7\uc740 \uc804\uc1a1 \uacfc\uc815\uc5d0\uc11c \uacf5\uaca9\uc790\uc5d0\uac8c \ub178\ucd9c\ub418\uac70\ub098 \ubcc0\uc870\ub420 \uc218 \uc788\ub2e4. \uc608\ub97c \ub4e4\uc5b4 \uac8c\uc784\uc5d0\uc11c \ub2e4\uc74c\uacfc \uac19\uc740 \ud328\ud0b7\uc744 \ubcf4\ub0b8\ub2e4\uace0 \ud558\uc790. \uacf5\uaca9\uc790\uac00 \ud328\ud0b7\uc744 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[],"class_list":["post-2401","post","type-post","status-publish","format-standard","hentry","category-server"],"_links":{"self":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts\/2401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2401"}],"version-history":[{"count":1,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts\/2401\/revisions"}],"predecessor-version":[{"id":2402,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts\/2401\/revisions\/2402"}],"wp:attachment":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}