0

I can think of where people use hashes and signatures. But where are MAC used in real life?

Are there any protocol in cryptography that uses MAC? Or examples where MACs are relevant?

1 Answer 1

9

MACs are used all the time. Any time you want authenticated encryption, that is you want to send messages that can't be tampered by an attacker who lacks your secret key, you need to apply a MAC to every message you send as well as check a MAC for every message you receive.

Examples that I use on a daily basis include:

4
  • I have a hard time figuring out in what part of TLS, a MAC is used. For SSH, is there a MAC included with every encrypted messages? Apr 27, 2014 at 23:19
  • @David天宇Wong - For TLS consult RFC 5246 Sections 1 "Message transport includes a message integrity check using a keyed MAC" and section 6. For SSH consult RFC 4253 Section 6; basically yes a MAC is included with every encrypted packet.
    – dr jimbob
    Apr 27, 2014 at 23:27
  • 1
    Also, it is used in good web apps to store your session cookie.
    – JZeolla
    Apr 28, 2014 at 13:14
  • @SteelCityHacker - Agreed, a MAC is certainly one way to generate session cookies to prevent having to store every session cookie in the DB. That is in the cookie you have user_data + MAC(user_data) (user data being, user ID, login time, expiry time) and then you can check the user by seeing that their session cookie has a MAC that validates their user info. (Granted an alternative way is to just generate a random UUID for each session and store that random UUID in the DB and check it every time).
    – dr jimbob
    Apr 28, 2014 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .