Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading HMAC on wikipedia and i was confused at a few points.

  1. Where do I use HMAC?
  2. Why is the key part of the hash?
  3. Even if someone successfully used a "length-extension attack", how would that be useful to the attacker?
share|improve this question
If anyone is curious what i wanted to know was hmac is a way to sign data using a symmetrical key. "Its more complex then hashing the message and key together which is not secure" is a bonus. –  acidzombie24 Sep 18 '12 at 19:09

3 Answers 3

up vote 20 down vote accepted

A message authentication code (MAC) is produced from a message and a secret key by a MAC algorithm. An important property of a MAC is that it is impossible¹ to produce the MAC of a message and a secret key without knowing the secret key. A MAC of the same message produced by a different key looks unrelated. Even knowing the MAC of other messages does not help in computing the MAC of a new message.

An HMAC is a MAC which is based on a hash function. The basic idea is to concatenate the key and the message, and hash them together. Since it is impossible, given a cryptographic hash, to find out what it is the hash of, knowing the hash (or even a collection of such hashes) does not make it possible to find the key. The basic idea doesn't quite work out, in part because of length extension attacks, so the actual HMAC construction is a little more complicated. For more information, browse the hmac tag on Cryptography Stack Exchange, especially Why is H(k||x) not a secure MAC construction?, Is H(k||length||x) a secure MAC construction? and HMAC vs MAC functions. There are other ways to define a MAC, for example MAC algorithms based on block ciphers such as CMAC.

A MAC authenticates a message. If Alice sees a message and a MAC and knows the associated secret key, she can verify that the MAC was produced by a principal that knows the key by doing the MAC computation herself. Therefore, if a message comes with a correct MAC attached, it means this message was seen by a holder of the secret key at some point. A MAC is a signature based on a secret key, providing similar assurances to a signature scheme based on public-key cryptography such as RSA-based schemes where the signature must have been produced by a principal in possession of the private key.

For example, suppose Alice keeps her secret key to herself and only ever uses it to compute MACs of messages that she stores on a cloud server or other unreliable storage media. If she later reads back a message and sees a correct MAC attached to it, she knows that this is one of the messages that she stored in the past.

An HMAC by itself does not provide message integrity. It can be one of the components in a protocol that provides integrity. For example, suppose that Alice stores successive versions of multiple files on an unreliable media, together with their MACs. (Again we assume that only Alice knows the secret key.) If she reads back a file with a correct MAC, she knows that what she read back is some previous version of some file she stored. An attacker in control of the storage media could still return older versions of the file, or a different file. One possible way to provide storage integrity in this scenario would be to include the file name and a version number as part of the data whose MAC is computed; Alice would need to remember the latest version number of each file so as to verify that she is not given stale data. Another way to ensure integrity would be for Alice to remember the MAC of each file (but then a hash would do just as well in this particular scenario).

¹ “Impossible” as in requiring far more computing power than realistically possible.

share|improve this answer
This man is a machine, great answer! –  James Andino Oct 14 '13 at 10:06
  • HMACS are used when you need to check two "integrity" and "authenticity". For eg: consider a scenario where you are sent a piece of data along with its hash -- you can verify the integrity of the message by recomputing the hash of the message and comparing it with the hash that you received. However, you don't know for sure if the message and the hash was sent by someone you knew/trusted. If you had resorted to using HMACS, you could recompute the HMAC using a secret key that only you and a trusted party know, and compare it with the HMAC you just received -- in effect, serving the purpose of "authenticity".

  • Like I mentioned earlier, the secrecy of the key ensures that the HMAC was computed by a trusted party.

  • HMACS are not keyed hashes. Length extension attacks are possible when you used keyed hashes, not HMACS. For further reading you might want to check out this.


Answer edited to answer comment below :- "I still don't understand why the key is in the message? Do I not know the public key of the party? If I know the public key then why is the key in the message rather me using the already known key? If I don't know the key then why would i trust that party?"

  • The key is not "in" the message. The key is used in generating the HMAC from a message. The key used for generating HMACS is not anyones "public key". Its more like a shared secret between two parties. You could check out the REST API authentication method for AWS stuff to better understand how HMACS are used for URL-signing.
share|improve this answer
I still don't understand why the key is in the message? Do I not know the public key of the party? If I know the public key then why is the key in the message rather me using the already known key? If I don't know the key then why would i trust that party? –  acidzombie24 Sep 13 '12 at 11:56
Answer to comment added as edit. –  uki Sep 13 '12 at 12:07
It still isn't super clear but now I figured it out. I use .NET to give me back a hash when signing so I never had to deal with this (I suspect they use HMAC but i am too lazy to confirm atm). Now I understand it as the technique used to sign data. HMAC is simply the hash data you attach with a message for use of verifying that the data has been signed with that key. I always have done signing with an asymmetrical key, I didn't realize it was done with a symmetrical key. I understand now. +1 accepted even tho it it isnt super clear in the answer. –  acidzombie24 Sep 13 '12 at 22:12
I did and Gilles explained it better. –  acidzombie24 Sep 18 '12 at 19:04

1 . You use HMAC whenever you want integrity of the data maintained (and authenticity)

2 . The key is part of the HMAC, since it is a shared secret known between 2 parties only and only they can create the HMAC and no one else. (Ensures authenticity)

3 . Length extension attacks are not possible on HMAC. MAC's on the other hand simply appends key to the message, which is susceptible to it. HMAC was introduced to overcome this attack on MAC's.

share|improve this answer
+1 as I was confused why just concatinate the message and the key, and what difference a key has over just concatenating it. Although I'm still confused. –  rahmanisback Jan 26 at 10:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.