title: hmac key and salt length
body: <p>I'm using hmac sha1 to sign a userid which is passed to a third party service.
  The same secret is used for all users and the salt is unique for each user.</p>
  
  <pre><code>token = userid : timestamp+2hours : hmac(userid : timestamp+2hours, salt+secret)
  token_hex = hex(hash)
  </code></pre>
  
  <p>Will hmac work for short strings? userid:timestamp can be for example 12:1304985212
  Does the order of salt and secret matters? (salt+secret vs secret+salt)
  What should be the shared secret length and what should be the salt length?
  Can I use the same secret to also sign messages between the server and the remote service or is it better to generate a separate secret?</p>
  
  <p>Thanks</p>