What is the difference between the two algorithms?
One difference that I know of, is that MAC is keyed and hash is not.


To make it simple: usually a MAC is a Hash value encrypted with a secret key. For example, attackers can forge message and calculate a new hash, but he can't do so if the system requires hash to be encrypted with a secret key.

  • 16
    This answer is not accurate. This is not a helpful way to think about a MAC, nor is it typically how a MAC algorithm works.
    – D.W.
    Jan 26 '11 at 6:02
  • 2
    Hash is used to ensure message integrity, MAC is used for both integrity and authenticy. Most MAC alghoritms - is a combination of hash function with a secret key, which I call for simplicity "encryption" of hash value with a key en.wikipedia.org/wiki/File:MAC.svg Jan 26 '11 at 12:37
  • 6
    I don't know that that's the best way of looking at it. I don't think there's much of a distinction between integrity vs authenticity, when we're dealing with an active attacker who might modify messages transmitted. As for calling it "encryption", that is highly misleading and I strongly encourage you to avoid using that terminology: it does not correspond to how cryptographers talk, and in my experience, it often misleads inexperienced listeners.
    – D.W.
    Jan 30 '11 at 6:13
  • 2
    MACs are rarely constructed by encrypting a hash. For many types of encryption that'd be very weak. For example it'd suck with stream ciphers. It'd require a 256 bit hash and a 256 bit block cipher to be as secure as a normal 128 bit MAC. Feb 10 '13 at 10:38
  • 1
    @D.W. can you please advise a book with proper terminology and information on how to avoid the situation when "an active attacker might modify messages transmitted"? Mar 13 '16 at 10:51

A cryptographic hash function is a completely public, deterministic hash function which everybody can compute over arbitrary inputs. It takes as input a sequence of bits (any sequence of bits; some hash functions are formally limited to inputs of, say, less 264 bits, aka "2 millions of terabytes") and outputs values in a rather small space, typically a sequence of bits with a fixed size (e.g. always 160 bits with the standard hash function SHA-1). Good cryptographic hash functions respect some conditions which boil down to, informally, that they mix input data so thoroughly that we cannot figure it out afterwards.

A message authentication code is an algorithm which takes as input a message and a secret key and produces a fixed-sized output which can be later on verified to match the message; the verification also requires the same secret key. Contrary to hash functions where everything is known and attackers are fighting against mathematics, MAC make sense in models where there are entities with knowledge of a secret. What we expect from a good MAC is unforgeability: it should be infeasible to compute a pair message+MAC value which successfully verifies with a given key K without knowing K exactly and in its entirety.

Hash functions and MAC are thus distinct kind of algorithms with distinct properties and used in really distinct situations.

Some MAC algorithms (but certainly not all of them) can be thought of as "hash functions with a key" but this is a restrictive view. HMAC is a well-known MAC construction, which itself builds on an underlying hash function in a smart way. Indeed, security properties and models for hash functions and MAC are sufficiently distinct from each other that slapping a hash function and a key together does not necessarily yield a secure MAC, even if the hash function is secure (see the length extension attack which illustrates that point).

To some extent, we can state that a MAC algorithm which can operate securely without an IV must exhibit some hash-like properties (that's the reason I like HMAC: without an IV, it is much harder to get it wrong when implementing it). However, the Devil is in the details.

  • As you mentioned, a hash function can form the basis for a MAC. Block ciphers are the other building block of MACs and are called a CBC-MAC. The blocker cipher used in these functions can differ between implementations--DES, AES, etc.
    – freb
    Jan 21 '15 at 4:50

They are two totally different primitives. A MAC is used for message authentication, and is a symmetrically keyed primitive. A hash function can be used for many purposes, and has no special key input. MAC is an acronym of "message authentication code".

Don't be confused by the fact that some MAC algorithms (e.g., SHA1-HMAC) work by using a hash function as a subroutine. They're very different beasts.

  • Some examples of MAC algorithms: CMAC, SHA1-HMAC, MD5-HMAC, UMAC, Poly1305-AES.
  • Some examples of cryptographic hash functions: SHA256, SHA1, MD5.
  • 4
    HMAC is one of the algorithms which allows us to calculate MAC. Jan 26 '11 at 12:16

Found this to the point answer from another forum.

These types of cryptographic primitive can be distinguished by the security goals they fulfill (in the simple protocol of "appending to a message"):

Integrity: Can the recipient be confident that the message has not been accidentally modified?

Authentication: Can the recipient be confident that the message originates from the sender?

Non-repudiation: If the recipient passes the message and the proof to a third party, can the third party be confident that the message originated from the sender? (Please note that I am talking about non-repudiation in the cryptographic sense, not in the legal sense.) Also important is this question:

Keys: Does the primitive require a shared secret key, or public-private keypairs? I think the short answer is best explained with a table:

Cryptographic primitive | Hash |    MAC    | Digital
Security Goal           |      |           | signature
Integrity               |  Yes |    Yes    |   Yes
Authentication          |  No  |    Yes    |   Yes
Non-repudiation         |  No  |    No     |   Yes
Kind of keys            | none | symmetric | asymmetric
                        |      |    keys   |    keys

Please remember that authentication without confidence in the keys used is useless. For digital signatures, a recipient must be confident that the verification key actually belongs to the sender. For MACs, a recipient must be confident that the shared symmetric key has only been shared with the sender.

Click here for more info

  • 2
    Please provide a link to where this answer came from. Jun 15 '16 at 11:46
  • 1
    Some other people now have changed these definitions: a hash function does not provide integrity, while authentication is what we now call integrity (cf. crypto.stanford.edu/~dabo/cryptobook ). This change is for the best imo Jul 30 '16 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.