Hash-based Message Authentication Code (HMAC)
Anyone can compute a hash, including an attacker. HMAC adds a shared secret key to the hashing, so only someone who holds the key can produce a valid tag.
Why a hash is not enough, and how a key fixes it
Genuine SHA-256 and HMAC Simulated network and attackerTag lab
Genuine HMAC-SHA-256An HMAC is one box with two inputs: the message and the secret key. The plain hash from Tool 1 has only one input. That key is the whole difference.
Keys
Type in the message and watch both tags change completely, like a hash. With a different key, the same message gets a totally different tag.
Attack lab: can Mallory fool Bob?
Genuine tags and verification Simulated network and attackerYou can also edit the message in transit yourself.
What happened
Key ideas
MAC and tag
A Message Authentication Code (MAC) is a short value, the tag, computed from a message and a secret key. HMAC is the standard way to build a MAC from a hash function (RFC 2104, FIPS 198-1). Here we use HMAC-SHA-256.
One shared key
Sender and receiver hold the same secret key. That raises the same question as symmetric encryption: how do they share it safely? (Tools 4 to 6.)
Verifying
The receiver recomputes the tag from the received message and their own copy of the key, and compares. The tag is never "decrypted" or reversed.
What it gives
- Integrity: the message was not changed.
- Data-origin authentication: it was produced by someone holding the key.
What it does not give
- Confidentiality: the message travels in clear text.
- Non-repudiation: both sides hold the key, so either could have made the tag.
- Replay protection: a valid message and tag can be recorded and sent again unchanged.
Not a network MAC address
In cryptography, MAC means Message Authentication Code. It has nothing to do with the MAC address of a network card.
Why not just compute "hash of key followed by message"? Home-made combinations like this have known weaknesses (for example length-extension attacks). HMAC is an established construction designed to avoid them. Never invent your own.
Hash, HMAC, signature, authenticated encryption: what is the difference?
| Plain hash | HMAC | Digital signature | AES-GCM | |
|---|---|---|---|---|
| Key | None | One shared secret key | Key pair: private to sign, public to verify | One shared secret key |
| Who can create it | Anyone | Anyone with the shared key | Only the private-key holder | Anyone with the shared key |
| Who can verify it | Anyone | Anyone with the shared key | Anyone with the public key | Anyone with the shared key |
| Integrity | ⚠ Only with a trusted hash | ✔ Yes | ✔ Yes | ✔ Yes (built-in tag) |
| Origin authentication | ✖ No | ✔ Yes | ✔ Yes | ✔ Yes |
| Confidentiality | ✖ No | ✖ No | ✖ No | ✔ Yes |
| Non-repudiation | ✖ No | ✖ No | ✔ Yes | ✖ No |
Common misconceptions
Where you meet HMAC
Webhooks and APIs
Services such as payment providers or GitHub send a request with an HMAC of its content. The receiving server recomputes it with the shared secret and rejects anything that does not match.
Session tokens
JSON Web Tokens signed with HS256 are HMAC-SHA-256: the server can detect if a user edits their own token (for example to become "admin").
Authenticator apps
The 6-digit codes in apps like Google or Microsoft Authenticator (TOTP) are an HMAC of the current time with a secret shared when you scanned the QR code.
Secure protocols
IPsec VPNs and older TLS versions protect each packet with an HMAC. TLS 1.3 uses HMAC-based functions to derive its keys.
Challenges
1. Spot the forgery
Bob received three messages. He shares the key below with Alice. Only one message is genuine. Verify each one.
2. Who could have sent this?
Alice and Bob share an HMAC key. Bob shows a judge a message "Alice owes Bob €5 000" with a valid tag. Can the judge conclude that Alice wrote it? Which tool would solve this?
Show answer
3. Which property?
For each mechanism, which properties does it give: hash, HMAC, digital signature, AES-GCM? Fill in the table on paper, then compare with the table in the Explain section.