There are different ways to perform a MAC, but without doubt the most used and efficient in many cases is HMAC, this serves to verify that the message has not been altered. A hash such as sha-256, sha-512 or bcrypt is regularly used.

That is my first doubt. bcrypt never generates the same hash, how do I see if the hash of the sender is equal to that of the receiver if they will never be the same (because they implement a SALT)?

1 Answer 1


The sender needs to send the salt along with the hash so that the receiver uses the same salt when computing the bcrypt hash.

That said, bcrypt is designed to be a password hashing function, it's not meant to be used inside an HMAC. There is no need to use a salted hash with an HMAC, so I would suggest you use HMAC-SHA256.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .