I understand the basic operational theory behind MAC, but I'm getting tripped up on some of the finer details. Also the differences between MAC, HMAC and MIC are getting lost on me, including the different utilizations between them, the benefits of using one over the other in a given situation, etc. As such, I'm hoping I can get an overview on MACs, covering a few specific points.
Firstly, I get how a MAC verifies that the message is unaltered, but I don't get how that translates to verifying the message originator. Just because the message is unaltered doesn't mean it came from a specific host. To me that sounds like there is an assumption that the session key has not been compromised. So this would protect against message tampering but not eavesdropping?
Secondly, is the MAC based on the plain-text or the cipher-text? Also, how is the key selected? Is it unique to the MAC or is it related to the session key?
As far as I understand MAC vs HMAC vs MIC, HMACs are keyed hash functions which use the message and a key to produce a digest used in the verification process, MACs do the same but can be based on universal hashes or even algorithms which are not hashes, and MICs can be based on any algorithm that can be used as a MAC, but do not utilize keys, and so can only be used to provide message integrity, and not authentication. If I'm mistaken on any of that, I'd appreciate some clarification.
As with my previous post, I know this is probably an extremely basic question to be asking in this forum, so I'll apologise if this is irksome to anybody. But I'm only just getting my feet wet in cryptology. I'm not even sure that my understanding on this topic is incorrect, I'm just not 100% sure that it is correct.