An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function
H, and calculating the hash
H(key + H(key + message)), where
+ signifies concatentation (Source). The
key is secret, and is reused for multiple HMAC calculations.
A related cryptographic technique is "salting." This is commonly used when storing passwords: each password will have a unique salt (or "nonce"), and you store the hash
H(salt + key) and the salt together in the database. The salt is not encrypted, is not reused for other passwords, and is not a "secret" like the HMAC key.
My question is: does it add any security to add a random salt to the message you are validating with HMAC?
In my situation, the "message" I am validating is a six digit number. My "gut" was to use a salt (perform HMAC on
salt + my six digit number) to protect against rainbow tables, but then it occurred to me that, since I'm using a 512-bit HMAC key generated by a cryptographically secure random number generator, there may be no added security. If I'm understanding it correctly, this answer (to a question about HMACing short inputs) means that there is no added security.
However, I am not completely certain. So, can someone clarify? Is there any value in adding a salt to your message prior to determining the HMAC?