16
$\begingroup$

Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is there any reason to prefer one over an other? In practice HMAC seems to be much more widely used, is that a result of cryptographic, or social reasons?

$\endgroup$
18
$\begingroup$

HMAC was there first (the RFC 2104 is from 1997, while CMAC is from 2006), which is reason enough to explain its primacy. If you use HMAC, you will more easily find test vectors and implementations against which to test, and with which to interoperate, which again explains continued primacy. Being the de facto standard is a very strong position.

On many embedded systems, one may expect HMAC to be faster than CMAC, because hash functions are usually faster than block ciphers. This is not true if the platform includes some hardware optimization for a specific block cipher (e.g. dedicated AES opcodes), or if the messages are short (HMAC has the same asymptotic cost as hashing, but also a fixed overhead), or if you do something stupid like selecting a slow hash function as basis for HMAC (e.g. Whirlpool). As with all performance things, actual measures are needed to reach any kind of definitive conclusion.

If you need to both encrypt and MAC, then the smart thing to do is not HMAC or CMAC, but rather to use an authenticated encryption mode which will do both properly, simultaneously, and at a lower cost (or at least so it is hoped). Usual candidates are EAX and GCM. There is an ongoing open competition for finding new, better AE modes.

$\endgroup$
  • $\begingroup$ Hashes usually faster than block ciphers sounds weird. After all most hashes are built from block ciphers and have stronger requirements than PRPness. Could be a historical accident since hashes are commonly ARX based, which is efficiently implementable in software, but that's no inherent property of hashes. $\endgroup$ – CodesInChaos Apr 22 '14 at 18:57
  • $\begingroup$ Beware: MD hash functions like SHA-1 are built out of a block cipher, but with the data as key, which apparently allows for better bandwidth. At least we can empirically notice that the SHA-3 competition yielded algorithms which are quite faster than all AES candidates on the same hardware. Even AES-based SHA-3 candidates (e.g. ECHO) turned out to be quite faster than AES itself on the same machine. $\endgroup$ – Thomas Pornin Apr 22 '14 at 19:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.