English
Menu

What is HMAC?

A message authentication code built from a hash function and a shared key. Using two values derived from the key, K ⊕ ipad and K ⊕ opad, it applies the hash function twice: HMAC(K, m) = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ m)). Unlike simply hashing the key concatenated with the message, it is not vulnerable to length extension attacks even with a Merkle–Damgård hash function such as SHA-256. It is specified in RFC 2104 and widely used in TLS, IPsec, JWT and the key derivation function HKDF.

Japanese name: HMAC

HMAC appears in 4 practice questions across 2 topics, including Applied Cryptography, Information Security Basics.

Field: Applied Cryptography

Try it: questions about HMAC

Which statement correctly compares a message authentication code (MAC) with a digital signature?

  1. AA MAC can be verified by anyone with a public key, so its non-repudiation effect is stronger than that of a digital signature
  2. BA MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message
  3. CA MAC just computes a hash value without a key, so even if an attacker alters the message and recomputes the MAC, the receiver can notice
Show answer and explanation

Answer: B. A MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message

A message authentication code (MAC) is a short value computed from a message and a symmetric key; HMAC, which uses a hash function, is common. The receiver recomputes it with the same key and compares; if they match, the message came from someone who knows the key and was not altered on the way. An attacker who does not know the key cannot produce a correct MAC for an altered message. However, the receiver holds the same key and can also create MACs. The receiver therefore cannot prove to a third party that the sender created the message, so a MAC does not provide non-repudiation. A digital signature can be created only with the sender's private key and verified by anyone with the public key, so it can provide non-repudiation. MACs, on the other hand, are light to compute and widely used for checks between the two parties, such as detecting tampering in each packet of a connection. A plain hash value without a key can be recomputed by an attacker along with the altered message, so it cannot detect deliberate tampering.

Using the hash SHA-256(K ‖ m) of a secret key K concatenated with a message m as a tag for detecting tampering is considered dangerous. Which of the following is the reason?

  1. AIf the tag and the input length are known, the tag of a message with data appended after m can be computed without knowing K
  2. BAn efficient method is known for working back from the SHA-256 output to just the key K placed at the start of the input
  3. CPlacing the key K in front of the message makes the input longer, and with SHA-256 this makes collisions easier to find
Show answer and explanation

Answer: A. If the tag and the input length are known, the tag of a message with data appended after m can be computed without knowing K

In a Merkle–Damgård hash function such as SHA-256, the output hash value is exactly the internal state after the last block has been processed. An attacker can therefore take the tag as the internal state and continue the computation, obtaining the hash of K ‖ m followed by padding of a fixed form and arbitrary data, without knowing K (a length extension attack). HMAC, which uses two values derived from the key and hashes the inner hash value once more together with the key, prevents this attack. SHA-3 is not vulnerable to this attack by its construction, so KMAC, which simply puts the key in front, has also been standardized.

HMAC in the explanations

Questions that mention HMAC (4)

  1. Which statement correctly compares a message authentication code (MAC) with a digital signature?
  2. Using the hash SHA-256(K ‖ m) of a secret key K concatenated with a message m as a tag for detecting tampering is considered dangerous. Which of the following is the reason?
  3. In protocols such as TLS 1.3, the shared secret obtained from an ECDHE key exchange is not used directly as an encryption key; instead keys are made by passing it through a key derivation function (KDF) such as HKDF. Which of the following is an appropriate reason?
  4. Which of the following is the correct combination of what the TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 specifies?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Hash function TLS Diffie–Hellman key exchange Message authentication code Digital signature Information entropy AES (Advanced Encryption Standard) Authenticated encryption (AEAD) RSA cryptosystem Birthday attack

Back to the glossary