Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.

What exactly is the difference between an HMAC and a hash of a span of input data?

share|improve this question
add comment

3 Answers

The recent question concerned proper usage of hash functions as part of key derivation functions. A HMAC is a Pseudo Random Function, in the (informal) sense that if someone chooses a function F which is either a HMAC with a secret key, or a function selected at random from the set of all functions with the same domain and value set, you can't tell which is which.

A Hash function OTOH formally only has to meet certain criteria, such as primary preimage resistance, secondary preimage resistance and collision resistance. These criteria do not necessarily imply that the lower and upper halves of a digest value are independent, in the sense required for the purpose at hand.

share|improve this answer
add comment

Put simply, if you're using a simple hash of a file to guarantee file-integrity, then an attacker could modify the file, re-calculate the hash of the modified file, and replace the old hash with the modified one. With a HMAC, a key is used when calculating the hash value, so unless the attacker has the key, they're unable to calculate a valid hash value of the modified data.

share|improve this answer
add comment

TL;DR, an HMAC is a keyed hash of data.

A good cryptographic hash function provides one important property: collision resistance. It should be impractical to find two messages that result in the same digest.

An HMAC also provides collision resistance. But it also provides unforgeability. In order to generate an HMAC, one requires a key. If you only share this key with trusted parties, given an HMAC signature, you can be confident that only one of the trusted parties could have generated that signature.

Due to common properties of hash functions, an HMAC is not as simple as hashing the data appended to the key. This construct is vulnerable to length-extension attacks where an attacker can take a message and its HMAC signature, and use this to construct a longer message with a valid signature (thus breaking the guarantee of unforgeability).

share|improve this answer
    
Please note that "HMAC" is a specific construction of a MAC (from a hash function), and most of your description applies to MACs in general. –  Paŭlo Ebermann Feb 27 '13 at 21:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.