# UMAC: to what extent is it in use today?

Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the idea.

However, I've also discovered UMAC which sounds very much like a hash function/lookup table to select an appropriate hash for use in a MAC, via, crucially, "some secret process".

Is selecting an algorithm secretly in this way secure? Is the only secret in UMAC the algorithm in use, or does it combine some known secret as HMAC does? In other words, is it HMAC with a random H?

Finally, is this being used anywhere? HMAC has its own RFC whereas UMAC does not appear to have yet been so well adopted.

-

UMAC is described in full details in RFC 4418.

When the RFC talks about "secret selection", it really means "there is a secret key involved here". UMAC works with universal hashing, which can be viewed as a family of hash functions, and a key which selects which hash function we are talking of. The term "hash function" might be a bit confusing here, because this is not at all the same kind of beast than, say, SHA-256. These "hash functions" would be utterly weak if left alone in the wild.

So UMAC works like this:

• There is a nonce which must be used only once; for each new message a new nonce value must be selected (this is extremely important).
• There are two keys K1 and K2. K1 selects the universal hash function h in its family, while K2 is used in a suitable function which can operate on a block; namely, the AES or another block cipher.
• The input message is processed with h, and the output of h is then encrypted by XORing it with AESK2(nonce).

The idea is that the hash function h (selected by K1) remains "hidden" by the final encryption. Thanks to the nonce, and assuming that the final encryption is decent, successively MACed messages leak no information whatsoever on h to the attacker. This is valid even in the presence of a very lightweight h, much faster than a conventional hash function.

UMAC is not much used by itself, because it is quite recent, and the nonce is a hard requirement, quite similar to IV management for block ciphers. HMAC is much easier, in the sense that it is much harder to get it wrong. UMAC or UMAC-like systems are however quite popular when integrated with encryption, because the nonce/IV requirement can then be shared. This is how OCB and GCM work, for instance.

-
I think that pretty much covers everything I wanted to know... have a green tick! –  Ninefingers Jul 26 '11 at 17:06
I just read the RFC, and it looks that K₁ and K₂ are in fact the same key K (section 4.1). (Though in h the key is a bit more twisted using the key derivation function.) –  Paŭlo Ebermann Jul 26 '11 at 17:50

By the way, if you're interested in UMAC, you may also be interested in VMAC, Poly1305, or Badger. If I had to choose one MAC to use today, without doing any further research on it, I would use Poly1305.

-