1

I was recently studying about Message Authentication Code (MAC) and Hashed based Message Authentication Code( HMAC).

What I understood is MAC takes the message and a shared secret key and applies the MAC algorithm and the output is appended with the original message and sent to the server and the server uses the same key, message and applies the MAC algorithm and matches the output of the algorithm with the one appended to the packet received. If both of them matches then the data is not tampered and comes from a good source.

While in the HMAC, the message is hashed using MD5 or SHA algorithms and the output of the hash is appended with the shared key and again hashed and this output is appended with the message and sent to the server and the server also uses the same methods to see if the message is tampered or not.

But how is HMAC better than MAC? it just includes another round of hashing.

3
  • 2
    I love how this can be shortened to HMAC ⊂ MAC
    – J.A.K.
    Feb 27, 2017 at 16:47
  • hashes can be faster to compute than "macing" a large message.
    – dandavis
    Feb 27, 2017 at 19:21
  • 5
    I'm voting to close this question as off-topic because it's purely based on OP's failure to research the terms in question; otherwise, OP would have noticed that HMAC is just a specific MAC. Feb 27, 2017 at 19:47

1 Answer 1

5

HMAC is an implementation of MAC.

MAC is just a name given to tools that authenticate messages.

HMAC is the name of an implementation of a MAC system using hash functions.

So there is no better one since 'a cryptographic hash function is only one of the possible ways to generate a MAC'.

Edit: see also this SO question over on crypto

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.