✅MAC

NEW

Also known as: Message Authentication Code

A symmetric-key algorithm that computes a cryptographic checksum to provide message integrity and authenticity.

DESCRIPTION

A message authentication code (MAC) verifies that data originates from someone holding a shared secret and has not been altered. MAC constructions include HMAC (hash-based), CMAC (block-cipher-based), and GMAC (Galois mode-based). MACs differ from digital signatures by requiring a shared secret and lacking non-repudiation. They are central to protocols like TLS, IPsec, and authenticated encryption schemes (AEAD). Correct key management, nonce handling, and separation of keys by purpose are critical for secure MAC usage.

ALTERNATIVE DEFINITIONS

IETF RFC 4949 Internet Security Glossary

Message authentication code (MAC): A cryptographic checksum computed from the data and a secret key.

Defines MAC as a keyed cryptographic checksum.

Source

NIST Computer Security Resource Center

A cryptographic checksum on data that uses a symmetric key.

Concise glossary emphasizing symmetric-key property.

Source

RELATED TERMS

HMAC CMAC GMAC Hash Function Keyed Hash Authenticated Encryption TLS

COMPETING TERMS

Digital Signature

RELATIONS

• Narrower: CMAC

KNOWLEDGE AREAS

Data Security Software Engineering Testing & Validation

TARGET AUDIENCE

Cybersecurity Engineer Security Architect Software Developer MLOps Engineer IT Auditor

EXTERNAL SOURCES

• Wikipedia - Message authentication code
• NIST SP 800-38B - CMAC recommendation specification
• IETF RFC 2104 - HMAC mechanism specification

TOP QUESTIONS

What security guarantees does a MAC provide?

It ensures integrity and authenticity under a shared secret, but not non-repudiation.

Category: Concept

How does a MAC differ from a digital signature?

MACs use symmetric keys shared by parties; signatures use asymmetric keys and enable non-repudiation.

Category: Comparison

When should I use a MAC?

Use a MAC when communicating parties can share a secret securely and need efficient integrity checking.

Category: Recommendation

What is a common mistake with MACs?

Reusing nonces or keys across different algorithms or contexts, leading to key-reuse vulnerabilities.

Category: Mistakes

Is HMAC still secure?

Yes, when used with secure hash functions like SHA-256 or SHA-3 and proper keys.

Category: Relevancy

Do MACs protect against replay attacks?

Not inherently; use sequence numbers, nonces, or timestamps in the data being MACed.

Category: Risk

Can I use the same key for encryption and MAC?

No. Use separate keys derived via a KDF to avoid cross-protocol attacks.

Category: Best practices

How are MACs used in TLS?

In older TLS versions, HMAC protects records; modern TLS 1.3 uses AEAD ciphers integrating authenticity.

Category: Example

How to verify a MAC securely?

Use constant-time comparison to prevent timing side-channel leaks.

Category: Requirements