What is the difference between .NET's HMAC and HMAC KeyedHashAlgorithm?

Question

What is the difference between Security.Cryptography.HMACSHA256.Create() and Security.Cryptography.KeyedHashAlgorithm.Create("HmacSHA256")?

Answer 1

First, about Security.Cryptography.HMACSHA256.Create() --

Create method is the method of HMAC class, from which HMACSHA256 is derived. In short:

public class HMACSHA256 : HMAC {
...
}

where HMAC is defined as:

public abstract class HMAC : KeyedHashAlgorithm {
    new static public HMAC Create () {
        return Create("System.Security.Cryptography.HMAC");
    }

    new static public HMAC Create (string algorithmName) {
        return (HMAC) CryptoConfig.CreateFromName(algorithmName);
    }
    ...
}

---

Second, about Security.Cryptography.KeyedHashAlgorithm.Create("HmacSHA256")

public abstract class KeyedHashAlgorithm : HashAlgorithm { 
    new static public KeyedHashAlgorithm Create(String algName) {
        return (KeyedHashAlgorithm) CryptoConfig.CreateFromName(algName);    
    }
    ...
}

---

As you can see, both calls result in calling CryptoConfig.CreateFromName method, but with different parameter values, i.e., System.Security.Cryptography.HMAC in first case, and HmacSHA256 in second case. Internally, there are some tables and reflection logic inside CryptoConfig.CreateFromName method.

The result of first call is SHA1 hash, and the result of second call is SHA256.