Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course.

When using Hash-based message authentication codes, I understand that you need to protect the front and back of the MAC to prevent an adversary from modifying the HMAC while in transit.

HMAC (K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m))

As such, a HMAC is constructed by hashing the XOR of the secret key K with the outer padding opad concatentated with the hash of the secret key K XORed with the inner padding ipad concatenated with the message.

Can someone explain how these “secret keys XORed with padding” protect the HMAC from modification by an adversary (such as appending data to the end of the MAC)?

share|improve this question
An HMAC has a fixed length. Appending data to it would make it trivially invalid. – Stephen Touset Jan 1 '14 at 21:51
@StephenTouset, by "appending data to the end", I think George is referring to a length extension attack, which is not trivial. – David Cary Jan 2 '14 at 1:45
up vote 3 down vote accepted

To attack a MAC in general, the attacker needs to find a valid MAC of a message that they do not have the MAC for (or find a message collision that allows a different message to have the same MAC digest). In this case, the attacker would be appending data to the original message, not the MAC itself, and trying to obtain a valid MAC for the new message. In specific, it sounds like you are thinking of length-extension attacks.

In HMAC, the inner hash by itself would be vulnerable to a length-extension attack and the attacker could successfully calculate a valid inner hash digest without access to the key. However, the outer hash isn't vulnerable to a length-extension attack since the client performing the HMAC authentication is only going to input the fixed length string key || inner_hash into it. The attacker only controls variable-length input to the inner hash, not the outer hash.

This is more-or-less addressed by this answer to another question. Relevant excerpt:

the role of the inner function is to provide collision-resistance (to compress a long message down to a short fingerprint, in a way so that someone who does not know the key cannot find a pair of messages with the same fingerprint), and the role of the outer function is to act as a message authentication code on this fingerprint.

share|improve this answer
To extend your answer to an unanswered part of the question, the particular values for ipad and opad aren't critically important. The security proof for HMAC only requires the inner key and outer key to be different by at least one bit. The values for ipad and opad have a large hamming distance, ensuring that a high number of bits are different. This is (AFAIK) simply an attempt to be as conservatively defensive as possible. – Stephen Touset Jan 2 '14 at 2:13
Thanks so much for your answers! – user11184 Jan 2 '14 at 20:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.