# Authenticating a message with HMAC vs AES-CBC

Given some string s I want to sign, are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?

1. s + HMAC(s, secret_key)

2. AES_CBC(s + string_of_zeroes, secret_key)

And validation:

1. recalculate HMAC of first part of message and compare it to second one

2. decrypt message and verify that it ends with string_of_zeroes

If that is true, string_of_zeroes of what length should be taken to make them equivalent?

• HMAC produces a message authentication code, not a signature. – mikeazo Sep 1 '16 at 15:58
• AFAIK MAC is a signature. At least I do not know another term for generic way to validate message integrity. – Sergey Alaev Sep 1 '16 at 16:09
• @SergeyAlaev, no MAC is not a signature. See here for differences. That said, what mode-of-operation are you planning on using for AES? – mikeazo Sep 1 '16 at 16:17
• Maybe you are asking about CBC-MAC security? - en.wikipedia.org/wiki/CBC-MAC – kludg Sep 1 '16 at 16:28
• @SergeyAlaev If CBC-MAC is what you are looking for, I suggest you read Why I hate CBC-MAC. – mikeazo Sep 1 '16 at 16:58

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?
Hence, if s is (at least) two blocks long, an attacker can freely modify the first block of the ciphertext; the decryption will still have the string of zeros still in place (as that wasn't modified), and so the attacker has succeeded in undetectably modifying the string.