Performing a cryptographically secure HMAC using multiple input parameters I'm using an HMAC as a way to generate a deterministic challenge token for an authentication system.

I've effectively got three string inputs plus a key:


Client IP address (string, eg: "127.0.0.1")
Client nonce (string, eg: "2325363F")
Linux epoch (string, eg: "594077C6")


My key is 256 bit (32 bytes) array.

How should I be performing the HMAC, is it really just a simple case of using string concatenation?


  HMAC(key,input1|input2|input3)


I'm fairly confident the above is just as secure as a hash tree or doing multiple HMAC operations, but would like to confirm my suspicions.
Yes, you can simply concatenate unless the encoding is not canonical, e.g. when the order isn't set or when the dynamic size of the fields make it possible that there is room for overlap between the fields.

It does seem that you've chosen string representations while it would be easier to use encoding to bytes directly. E.g. an IP 4 address usually consists of just 4 bytes. The seconds since the Linux epoch could be a number encoded into 32 bits. That way the chance of overlap is also zero because the field boundaries would be well defined.

Another issue is that you need to make the character encoding explicit., e.g. aways use US-ASCII or UTF-8.