MAC and HMAC

MAC / HMAC - Message Authentication Code / Hash Bashed Message Authentication CodesPractical Networking · why a hash alone is not enough, then MAC and HMAC, 7 minMAC & HMAC (with Animations)Cyber Security Entertainment · MAC and HMAC with animations, 6 minMessage Authentication Codes: CMAC and HMACCryptography · CMAC and HMAC constructions, 10 min105 keyed-Hash Message Authentication Code HMAC: Get a Gut Level UnderstandingBrent Bilger · HMAC inner and outer hash, ipad and opad, 7 min

Message authentication codesSearch on YouTubeBookmarkSaved

DefinitionSearch on YouTubeBookmarkSaved

A MAC (message authentication code) is a small fixed-sized block of data. An algorithm generates it from the message and a secret key:

$\text{MAC} = C(K, M)$

• The MAC depends on both the message and the secret key.
• It is like encryption, but it need not be reversible.
• The sender appends the MAC to the message as a "signature".
• The receiver does the same computation on the message and checks that the result matches the MAC.
• This gives assurance that the message is unaltered and comes from the sender.

The slide figure shows this flow. Source A computes $C(K, M)$ and sends $M$ with $\text{MAC}(K, M)$. Destination B computes $C(K, M)$ with the same $K$ and compares the two values.

MAC with encryptionSearch on YouTubeBookmarkSaved

The MAC gives authentication. You can also use encryption for secrecy.

• Generally, use separate keys for the MAC and for the encryption.
• You can compute the MAC before or after the encryption.
• The slide says that "before" is generally regarded as better, "but see Generic Composition".

Why use a MACSearch on YouTubeBookmarkSaved

• Sometimes only authentication is needed.
• Sometimes authentication must persist longer than the encryption, for example in archival use.

A MAC is not a digital signature. It does not give non-repudiation. The sender and the receiver share the key $K$. Thus a third party cannot tell which of the two made a given MAC.

MAC propertiesSearch on YouTubeBookmarkSaved

Cryptographic checksumSearch on YouTubeBookmarkSaved

A MAC is a cryptographic checksum:

$\text{MAC} = C_K(M)$

It condenses a variable-length message $M$, with a secret key $K$, to a fixed-sized authenticator.

• It is a many-to-one function. Potentially many messages have the same MAC.
• But it must be very difficult to find these messages.

RequirementsSearch on YouTubeBookmarkSaved

The MAC must satisfy these requirements, because of the types of attacks:

1. If an attacker knows a message and its MAC, it is infeasible to find another message with the same MAC.
2. MACs must be uniformly distributed. For an $n$-bit MAC, two random messages have the same MAC with probability $2^{-n}$.
3. The MAC must depend equally on all bits of the message.

HMACSearch on YouTubeBookmarkSaved

ComponentsSearch on YouTubeBookmarkSaved

HMAC (hash-based message authentication code) is a MAC that uses a cryptographic hash function, like SHA-256 or SHA-512, with a secret key. It verifies both the integrity and the authenticity of a message.

HMAC combines:

• A secret key $K$, known only to the sender and the receiver.
• A hash function $H$, such as SHA-256, SHA-512 or MD5.

Then it does two hashing operations with two special padding constants:

Each pad is repeated to the hash block size, so that it can be XORed with the padded key.

Formula and notationSearch on YouTubeBookmarkSaved

$\text{HMAC}(K, M) = H\left( (K \oplus \text{opad}) \,\Vert\, H\left( (K \oplus \text{ipad}) \,\Vert\, M \right) \right)$

ProcessSearch on YouTubeBookmarkSaved

1. Prepare the key.
   • If the key $K$ is longer than the block size, hash it.
   • If $K$ is shorter, pad it with zeros to the block size (for example, 64 bytes for SHA-256).
2. Inner hash. Compute $\text{InnerHash} = H((K \oplus \text{ipad}) \,\Vert\, M)$.
3. Outer hash. Compute $\text{HMAC} = H((K \oplus \text{opad}) \,\Vert\, \text{InnerHash})$.

The sender and the receiver both compute this value. If the results match, the message is verified.

ExampleSearch on YouTubeBookmarkSaved

The slide example uses hash function SHA-512, key $K$ and the message "Hello":

$\text{HMAC}(K, \text{``Hello''}) = \text{SHA512}\left( (K \oplus \text{opad}) \,\Vert\, \text{SHA512}\left( (K \oplus \text{ipad}) \,\Vert\, \text{``Hello''} \right) \right)$

The same steps in code form:

inner = sha512((K xor ipad) || "Hello")
tag   = sha512((K xor opad) || inner)

SHA-512 has a block size of 1024 bits (128 bytes), so the key is padded to 128 bytes.

HMAC in practiceSearch on YouTubeBookmarkSaved

SecuritySearch on YouTubeBookmarkSaved

• Integrity: if one bit of the message changes, the HMAC output changes very much.
• Authentication: only a person who knows the secret key can make a valid HMAC.
• Resistance to length extension attacks: plain hash-based verification, such as $\text{SHA256}(M)$, has this weakness. HMAC prevents attackers from appending extra data.

Use casesSearch on YouTubeBookmarkSaved

• TLS / HTTPS: verify data packets between the client and the server.
• IPSec / VPNs: message integrity.
• JWT (JSON Web Tokens): HMAC-SHA256 signs the tokens.
• APIs: authentication headers verify the requests.

Design objectivesSearch on YouTubeBookmarkSaved

1. Use hash functions without modifications.
2. Allow easy replacement of the embedded hash function.
3. Preserve the original performance of the hash function, without significant degradation.
4. Use and handle keys in a simple way.
5. Have a well understood cryptographic analysis of the strength of the authentication mechanism.

Quick self-testSearch on YouTubeBookmarkSaved