# HMAC vs MAC functions

I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.

• What are principle differences?
• When to use one and when the other?(Typical Use Cases)
-
HMAC is a MAC algorithm. The term MAC algorithm refers to any algorithm that authenticates a message. There are other MAC algorithms besides HMAC, such as VMAC. –  Chris Smith Jun 16 '12 at 13:45
@ChrisSmith - thks, I understand...so updating my question, what are typical use cases just of HMAC functions? –  Matteo Jun 16 '12 at 14:31
The same as any other MAC algorithm. HMAC just has the added advantage that it doesn't require a MAC IV. Its typical uses are the same as any other MAC algorithm, ensuring the authenticity and integrity of a transmitted message for example. –  Chris Smith Jun 16 '12 at 15:52

## 1 Answer

As Chris Smith notes in the comments, HMAC is a specific MAC algorithm (or, rather, a method for constructing a MAC algorithm out of a cryptographic hash function). Thus, HMAC can be used for any application that requires a MAC algorithm.

One possible reason for requiring HMAC specifically, as opposed to just a generic MAC algorithm, is that the HMAC construction actually provides (as long as the underlying hash function satisfies the appropriate assumptions) stronger security properties than what's required of a MAC. For example, nothing in the definition of a secure MAC algorithm (resistance to existential forgery under a chosen-plaintext attack) says that the MAC output can't reveal information about the plaintext to an attacker. If the plaintext is secret but the MAC is public, that would obviously be bad. HMAC, however, is guaranteed not to reveal any information about the plaintext as long as the underlying hash function is secure.

In particular, Bellare has shown that HMAC is a pseudo-random function (PRF) as long as the compression function of the underlying hash is also a PRF, and a "privacy-preserving MAC" (PP-MAC) as long as the compression function of the underlying hash is also a PP-MAC. Both of these are strictly stronger security properties than what's required of a plain MAC; in particular, being a PRF is a very strong security property — it essentially says that there's no practical way for an attacker to say anything about the output of the function based on the input, or vice versa, except for the obvious fact that the same input always yields the same output. There are many use cases for which a PRF will do whereas a plain MAC may not; HMAC, instantiated with a secure hash function, can be used for those.

Also, as Chris notes, some other MAC algorithms require a random IV to be secure; HMAC does not, so it can be used even in situations where deterministic output is required, or where messages must be kept as short as possible.

As for why you might not want to use HMAC, well, one reason is that it's not really optimized for speed. Dedicated MAC functions, particularly those based on universal hashing (the Carter–Wegman construction) like UMAC and VMAC, can be significantly faster. Also, MACs based on block ciphers (such as CMAC) can be very useful on limited platforms where an efficient block cipher primitive (like AES) is available but a secure hash function is not.

-