HMAC-SHA-256

HMAC vs. digital signature

An HMAC tag is verified using the same secret key that produced it. A digital signature is verified using a public key — anyone with the public key can verify; only the holder of the private key can produce. HMAC is symmetric authentication; digital signature is asymmetric authentication.

Why SkyeConnex carries both

Every signed compliance report and integrity certificate produced by SkyeConnex is dual-signed: with HMAC-SHA-256 for the legacy online-verify round-trip, and with ML-DSA-87 (FIPS 204 post-quantum signature) for offline non-repudiation. The HMAC preserves compatibility with existing customer integrations that verify via API; the PQ signature delivers genuinely offline-verifiable evidence.

The trust difference

HMAC verification requires the verifier to call back to the platform — because only the platform knows the secret. That is "trust us, the secret matches" — useful but not non-repudiation. With ML-DSA-87 and a published public key, the platform genuinely cannot deny having issued a report, and the verifier never depends on the platform's availability or honesty to check. The two together let SkyeConnex serve both legacy automation and rigorous audit / legal-evidentiary use cases.

Operationally

HMAC computation is fast — submicrosecond on modern hardware. Verification is equally fast. The pattern of "compute on the server, verify on the client through the server" is standard and well-understood; HMAC-SHA-256 supports it cleanly.

When customers stop relying on HMAC

As organisations migrate their verifier infrastructure to support FIPS 204, the ML-DSA-87 signature carries the full verification weight. The HMAC envelope remains as a backwards-compatibility artefact, but new verifiers should prefer ML-DSA-87 for the stronger guarantees.