Hash-based Message Authentication Code
Message authentication (integrity + origin with a shared key)
How it works
HMAC combines a secret key with a hash function in a nested construction: the key is mixed with two fixed pads and the message is hashed twice. Only someone holding the key can produce or verify the tag. It is used in JWT (HS256), TLS 1.2 record protection, IPsec, API request signing and as the building block of HKDF and PBKDF2.
Sizes: Output equals the underlying hash (for example 256 bits for HMAC-SHA256); may be truncated
Strengths
- Resists length extension, unlike hash(key || message).
- Works with any secure hash; HMAC-SHA256 is the common default.
- FIPS-approved (FIPS 198-1).
Weaknesses and known attacks
- Provides no non-repudiation: both sides share the same key, so either could have created the tag.
- Tags must be compared in constant time to avoid timing attacks.
- Security depends on keeping the shared key secret and sufficiently long.
Use it for
- Message and API request authentication
- Integrity of tokens and cookies
- Building KDFs
Don't use it for
- Proving to a third party who sent a message (use a digital signature)
- Password storage on its own
Exam tip
HMAC gives integrity and authenticity but NOT non-repudiation, because the key is shared. If the question needs non-repudiation, the answer is a digital signature.
References
Go deeper
Crypto lab: practise encryption, hashing and signatures
SHA-2
Cryptographic hash functions
HKDF
Key derivation from high-entropy secrets
PBKDF2
Password-based key derivation and password hashing
Sign vs encrypt
Choosing the right key for confidentiality or authenticity
GCM
Authenticated encryption (AEAD) mode