# How does the secret key in an HMAC prevent modification of the HMAC?

Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course.

When using Hash-based message authentication codes, I understand that you need to protect the front and back of the MAC to prevent an adversary from modifying the HMAC while in transit.

HMAC (K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m))


As such, a HMAC is constructed by hashing the XOR of the secret key K with the outer padding opad concatentated with the hash of the secret key K XORed with the inner padding ipad concatenated with the message.

Can someone explain how these “secret keys XORed with padding” protect the HMAC from modification by an adversary (such as appending data to the end of the MAC)?

-
An HMAC has a fixed length. Appending data to it would make it trivially invalid. –  Stephen Touset Jan 1 at 21:51
@StephenTouset, by "appending data to the end", I think George is referring to a length extension attack, which is not trivial. –  David Cary Jan 2 at 1:45

In HMAC, the inner hash by itself would be vulnerable to a length-extension attack and the attacker could successfully calculate a valid inner hash digest without access to the key. However, the outer hash isn't vulnerable to a length-extension attack since the client performing the HMAC authentication is only going to input the fixed length string key || inner_hash into it. The attacker only controls variable-length input to the inner hash, not the outer hash.
To extend your answer to an unanswered part of the question, the particular values for ipad and opad aren't critically important. The security proof for HMAC only requires the inner key and outer key to be different by at least one bit. The values for ipad and opad have a large hamming distance, ensuring that a high number of bits are different. This is (AFAIK) simply an attempt to be as conservatively defensive as possible. –  Stephen Touset Jan 2 at 2:13