HMAC vs MAC functions

Question

I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.

• What are principle differences?
• When to use one and when the other?(Typical Use Cases)

Answer 1

As Chris Smith notes in the comments, HMAC is a specific MAC algorithm (or, rather, a method for constructing a MAC algorithm out of a cryptographic hash function). Thus, HMAC can be used for any application that requires a MAC algorithm.

One possible reason for requiring HMAC specifically, as opposed to just a generic MAC algorithm, is that the HMAC construction actually provides (as long as the underlying hash function satisfies the appropriate assumptions) stronger security properties than what's required of a MAC. For example, nothing in the definition of a secure MAC algorithm (resistance to existential forgery under a chosen-plaintext attack) says that the MAC output can't reveal information about the plaintext to an attacker. If the plaintext is secret but the MAC is public, that would obviously be bad. HMAC, however, is guaranteed not to reveal any information about the plaintext as long as the underlying hash function is secure.

In particular, Bellare has shown that HMAC is a pseudo-random function (PRF) as long as the compression function of the underlying hash is also a PRF, and a "privacy-preserving MAC" (PP-MAC) as long as the compression function of the underlying hash is also a PP-MAC. Both of these are strictly stronger security properties than what's required of a plain MAC; in particular, being a PRF is a very strong security property — it essentially says that there's no practical way for an attacker to say anything about the output of the function based on the input, or vice versa, except for the obvious fact that the same input always yields the same output. There are many use cases for which a PRF will do whereas a plain MAC may not; HMAC, instantiated with a secure hash function, can be used for those.

Also, as Chris notes, some other MAC algorithms require a random IV to be secure; HMAC does not, so it can be used even in situations where deterministic output is required, or where messages must be kept as short as possible.

As for why you might not want to use HMAC, well, one reason is that it's not really optimized for speed. Dedicated MAC functions, particularly those based on universal hashing (the Carter–Wegman construction) like UMAC and VMAC, can be significantly faster. Also, MACs based on block ciphers (such as CMAC) can be very useful on limited platforms where an efficient block cipher primitive (like AES) is available but a secure hash function is not.