DUO AUTH API HMAC signature

[er-praveen1]

Hi all,

As per the DUO AUTH API documentation, 

Lastly, compute the HMAC-SHA1 of this canonical representation, using your Duo application's secret key as the HMAC key. Send this signature as hexadecimal ASCII (i.e. not raw binary data). Use HTTP Basic authentication for the request, using your integration key as the username and the HMAC-SHA1 signature as the password.

Does this mean any caller is bound by these algorithms? Can I use a stronger algorithm say HMAC-SHA256 or 512?

[DuoKristina · Accepted solution]

Hey, we have a newer signing method using SHA-512 that is not in that document, but is supported by all our API clients on GitHub. You can see those signing details here: https://github.com/duosecurity/duo_hmac_python/blob/main/duo_hmac/duo_hmac.py.

[er-praveen1]

Thanks for the information.