What is Message authentication code?

A short value (MAC) computed from a message and a symmetric key shared by the sender and receiver. By recomputing it with the same key and comparing, the receiver can confirm that the message came from someone who knows the key and was not altered. Because the receiver can also create the same value, it cannot provide non-repudiation. HMAC is a typical example.

Japanese name: メッセージ認証コード

Message authentication code appears in 1 practice question across 1 topic, including Information Security Basics.

Field: Information Security Basics

Try it: questions about Message authentication code

Which statement correctly compares a message authentication code (MAC) with a digital signature?

  1. AA MAC can be verified by anyone with a public key, so its non-repudiation effect is stronger than that of a digital signature
  2. BA MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message
  3. CA MAC just computes a hash value without a key, so even if an attacker alters the message and recomputes the MAC, the receiver can notice
Show answer and explanation

Answer: B. A MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message

A message authentication code (MAC) is a short value computed from a message and a symmetric key; HMAC, which uses a hash function, is common. The receiver recomputes it with the same key and compares; if they match, the message came from someone who knows the key and was not altered on the way. An attacker who does not know the key cannot produce a correct MAC for an altered message. However, the receiver holds the same key and can also create MACs. The receiver therefore cannot prove to a third party that the sender created the message, so a MAC does not provide non-repudiation. A digital signature can be created only with the sender's private key and verified by anyone with the public key, so it can provide non-repudiation. MACs, on the other hand, are light to compute and widely used for checks between the two parties, such as detecting tampering in each packet of a connection. A plain hash value without a key can be recomputed by an attacker along with the altered message, so it cannot detect deliberate tampering.

Message authentication code in the explanations

Questions that mention Message authentication code (1)

  1. Which statement correctly compares a message authentication code (MAC) with a digital signature?

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Digital signature Hash function Cross-site scripting (XSS) Multi-factor authentication Phishing Principle of least privilege Public-key cryptography Ransomware Salt Social engineering

Back to the glossary