Summary
The HMAC operation seems to produce incorrect output when using with hex keys with bytes >= 0x80
Example
Openssl:
$ echo -n 'test' | openssl dgst -sha256 -mac HMAC -macopt hexkey:00000000000000000000000000000000
(stdin)= 43b0cef99265f9e34c10ea9d3501926d27b39f57c6d674561d8ba236e7a819fb
CyberChef:
https://gchq.github.io/CyberChef/#recipe=HMAC(%7B'option':'Hex','string':'00000000000000000000000000000000'%7D,'SHA256')&input=dGVzdA
Output (correct): 43b0cef99265f9e34c10ea9d3501926d27b39f57c6d674561d8ba236e7a819fb
Openssl:
$ echo -n 'test' | openssl dgst -sha256 -mac HMAC -macopt hexkey:00000000000000000000000000000080
(stdin)= 82eb64f8f0732e166df7ffa088393fcea946233c8df3f76d7dc1dde0a055ae4e
CyberChef:
https://gchq.github.io/CyberChef/#recipe=HMAC(%7B'option':'Hex','string':'00000000000000000000000000000080'%7D,'SHA256')&input=dGVzdA
Output (incorrect): 40793ae8db3df4bcb12aa92cd3a1ca619a55cc3070e0eb06dedb47afdd4c6e06
Summary
The HMAC operation seems to produce incorrect output when using with hex keys with bytes >= 0x80
Example
Openssl:
CyberChef:
https://gchq.github.io/CyberChef/#recipe=HMAC(%7B'option':'Hex','string':'00000000000000000000000000000000'%7D,'SHA256')&input=dGVzdA
Output (correct):
43b0cef99265f9e34c10ea9d3501926d27b39f57c6d674561d8ba236e7a819fbOpenssl:
CyberChef:
https://gchq.github.io/CyberChef/#recipe=HMAC(%7B'option':'Hex','string':'00000000000000000000000000000080'%7D,'SHA256')&input=dGVzdA
Output (incorrect):
40793ae8db3df4bcb12aa92cd3a1ca619a55cc3070e0eb06dedb47afdd4c6e06