What is the main difference between Message Authentication Codes (MACs) and hash function?

Is there any difference regarding their usage domains?

3 Answers 3


The major difference between hash and MAC is that anyone can calculate the first, but only those with the secret key can calculate the latter. For example, in the HTTPS protocol, a shared key is established between the server and client, and with that key, a MAC can be calculated on the data transferred. No one else may calculate the MAC themselves and therefore they cannot modified the data without being detected. Suppose HTTPS use SHA256 instead, then anyone can just inject their own data and the corresponding hash themselves. The hash would only be useful to defend against accidental corruption.

  • A hash function provides data integrity.

  • MAC provides data integrity and authentication

  • A hash functions takes only the plain text itself

  • MAC is an algorithm that relies on a secret private key (to achieve authentication, this same key is used for verification too) in addition to a message.

    The outputs of both algorithms are of a fixed size.

An example of each one:

  • Thank you for your answer, but I'm wondering is there any difference regarding their usage domains? Commented Oct 3, 2015 at 8:40

A message authentication code (MAC), as the name indicates, is used to authenticate a message — that is, to prove to a recipient that the message was generated by someone who knew a certain secret key (shared by the recipient).

In terms of usage,* MACs are similar to digital signatures; the main difference is that MACs are a form of symmetric cryptography, and so require the sender and the recipient to know the same secret key. Digital signatures, on the other hand, use asymmetric (public-key) cryptography — this allows the sender to retain their own private signing key, while giving others a separate public key that allows them to verify the signature, but not to generate any new valid signatures.

(Sometimes, the symmetric nature of MACs can be a feature. For example, MACs automatically provide deniable authentication: anyone who can verify the MAC can also forge it. More commonly, though, the reason for using MACs instead of signatures is that they're significantly smaller, simpler and faster to generate.)

*) The underlying cryptographic techniques used to construct MACs and digital signatures, however, are generally very different.

A cryptographic hash function, on the other hand, is a way to map long messages into short (say, 128 to 512 bit) bitstrings in a way that approximates a (theoretical) random oracle. In particular, with a secure hash function, it should be infeasible for anyone to:

  1. given an arbitrary hash value, find a message that hashes to that value ("preimage resistance"),
  2. given an arbitrary message, find another message that hashes to the same value ("second preimage resistance"), or
  3. find any two messages that hash to the same value ("collision resistance").

While cryptographic hash functions are sometimes used directly as checksums to verify data integrity, or to verify the correctness of a key or password without having to store the key/password itself, they are not by themselves secure against deliberate forgery: a hash function has no secret key, so anyone can calculate a valid hash for any message.

Rather, the main cryptographic use for hash functions is as building blocks for other cryptographic schemes, including MACs and digital signatures:

  • Most digital signature algorithms can directly sign only short messages. Thus, in practice, they're commonly used by first hashing the actual message into a short hash, and then signing the hash.

  • A very common use for hash functions is the HMAC construction, which allows a hash to be used as a MAC by combining the input with a secret key (in a particular way) before hashing it.

  • Hash functions are also commonly used for key derivation: they allow several seemingly random keys to be deterministically derived from a single master secret, in a way that keeps the master secret safe even if some of the subkeys are compromised.

In short, while there are certain technical similarities in the way (some) MACs and hash functions are constructed, and while there are ways to use a hash function to implement a MAC, the (direct) use cases for these two constructions are rather different.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .