Message authentication

Assurance of the source and integrity of a message against specified adversarial capabilities. Digital signatures permit public verification, whereas a message authentication code uses a shared secret; encryption alone need not authenticate.

A keyed function producing a tag that a holder of the shared secret can verify. Its message authentication security requires that valid tags for new messages cannot be forged under the allowed adversarial queries. Unlike a digital signature, verification is not inherently public and the verifier also knows a key capable of making tags.

HMAC constructs a message authentication code from a cryptographic hash function and a shared secret key. For a hash $H$ with input block size $B$ bytes, normalize the key to a $B$-byte string $K_0$: first hash it if it is longer than $B$, then pad with zero bytes. The construction isHere $\oplus$ is bytewise exclusive or, $\Vert$ is concatenation of strings, ipad repeats byte 0x36, and opad repeats byte 0x5c. The inner and outer keyed hashing stages are part of the construction, rather than interchangeable placements of a key beside a message.^[ref]

A concrete interoperability example uses SHA-256, a member of SHA-2. Its block size is64 bytes while its full digest is32 bytes. With a key of20 0x0b bytes and the ASCII message Hi There, the hexadecimal tag is b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7.^[ref]

The receiver recomputes the tag using the shared key and checks the received tag. HMAC authenticates the message without concealing its contents; encryption is a separate operation. Because both parties know the key, both can make valid tags. A valid tag also remains valid when the same authenticated message is sent again, so replay handling belongs to the surrounding cryptographic protocol.

HMAC's original analysis and design are due to Mihir Bellare, Ran Canetti and Hugo Krawczyk.^[ref]

Combine a secret randomly selected almost strongly universal hash family member with a fresh secret output mask. An observed message authentication code tag leaves the hash-selection key hidden, and the conditional hash bound controls substitution forgery probability. The message itself need not be encrypted. Mask reuse can reveal hash differences; repeated-use guarantees require fresh masks and an appropriate analysis of verification information. A one-use polynomial construction needs only two secret field elements, even for a much longer message.