Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is there any reason to prefer one over an other? In practice HMAC seems to be much more widely used, is that a result of cryptographic, or social reasons?

share|improve this question

1 Answer 1

up vote 12 down vote accepted

HMAC was there first (the RFC 2104 is from 1997, while CMAC is from 2006), which is reason enough to explain its primacy. If you use HMAC, you will more easily find test vectors and implementations against which to test, and with which to interoperate, which again explains continued primacy. Being the de facto standard is a very strong position.

On many embedded systems, one may expect HMAC to be faster than CMAC, because hash functions are usually faster than block ciphers. This is not true if the platform includes some hardware optimization for a specific block cipher (e.g. dedicated AES opcodes), or if the messages are short (HMAC has the same asymptotic cost as hashing, but also a fixed overhead), or if you do something stupid like selecting a slow hash function as basis for HMAC (e.g. Whirlpool). As with all performance things, actual measures are needed to reach any kind of definitive conclusion.

If you need to both encrypt and MAC, then the smart thing to do is not HMAC or CMAC, but rather to use an authenticated encryption mode which will do both properly, simultaneously, and at a lower cost (or at least so it is hoped). Usual candidates are EAX and GCM. There is an ongoing open competition for finding new, better AE modes.

share|improve this answer
Hashes usually faster than block ciphers sounds weird. After all most hashes are built from block ciphers and have stronger requirements than PRPness. Could be a historical accident since hashes are commonly ARX based, which is efficiently implementable in software, but that's no inherent property of hashes. – CodesInChaos Apr 22 '14 at 18:57
Beware: MD hash functions like SHA-1 are built out of a block cipher, but with the data as key, which apparently allows for better bandwidth. At least we can empirically notice that the SHA-3 competition yielded algorithms which are quite faster than all AES candidates on the same hardware. Even AES-based SHA-3 candidates (e.g. ECHO) turned out to be quite faster than AES itself on the same machine. – Thomas Pornin Apr 22 '14 at 19:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.