So we have the protocol:

$Bob \to Alice \Rightarrow m\ ||\ h(m, ``secretTag")$

With above scenario, a message is passed to Alice with an authentication tag to prove that the message was sent by Bob.

What is a better way of doing the tag? How could I incorporate a key into this?

A suggestion has been to use Digital signatures or HMAC, how are these better?

  • 3
    $\begingroup$ Digital Signatures or HMAC. $\endgroup$
    – SEJPM
    Commented Nov 14, 2016 at 22:41
  • $\begingroup$ What's the difference? $\endgroup$ Commented Nov 14, 2016 at 23:23
  • 2
    $\begingroup$ Digital signatures require an asymmetric key pair (e.g. RSA) with the public key at the receiver and the private key at the sender while HMAC requires a shared symmetric key. If you want to use a password string you may also require a PBKDF function such as PBKDF2 to derive the secret key. $\endgroup$
    – Maarten Bodewes
    Commented Nov 15, 2016 at 0:53
  • $\begingroup$ What makes RSA or HMAC better for this scenario? $\endgroup$ Commented Nov 15, 2016 at 8:44

1 Answer 1


Please read the article on HMAC. What you are trying is exactly what is described in the chapter design principle:

The design of the HMAC specification was motivated by the existence of attacks on more trivial mechanisms for combining a key with a hash function. For example, one might assume the same security that HMAC provides could be achieved with $MAC = H(key ∥ message)$. However, this method suffers from a serious flaw: with most hash functions, it is easy to append data to the message without knowing the key and obtain another valid MAC ("length-extension attack"). ...

There are only two differences to your idea:

  • Reverse the order of message and key/tag
  • The idea of having a "tag", where I can only assume it is the usual case as with passwords: Low entropy, unsuitable to be used as a cryptographic key.

So basically you should just use HMAC (if that fits your needs), but put your tag into a password-based key derivation function first, e.g. PBKDF2, scrypt or bcrypt. That key can then be used for HMAC.

Digital signatures on the other hand also offer non-repudiation, and HMACs don't because both the sender and the receiver know the same symmetric key and thus could both have created the HMAC.

  • $\begingroup$ This is great. thanks. Although in this example is the message being concatenated along with the hashed message. In other words is this happening: m || h(m,‘‘secretTag") So... "Message" + 85URYEQIA4 $\endgroup$ Commented Nov 15, 2016 at 21:03
  • $\begingroup$ Well yeah, a HMAC is not used to reconstruct the message. It is appended to the message itself for authenticity. That is given implicitly by the construction. $\endgroup$
    – tylo
    Commented Nov 16, 2016 at 11:00
  • $\begingroup$ I'm just confused as to why in the given scenario the message is being appended/concatenated to the hashed value. Doesn't that just reveal the contents of the message if an adversary were to spy on this? $\endgroup$ Commented Nov 16, 2016 at 11:09
  • $\begingroup$ Authentication has nothing to do with confidentiality, which is usually achieved by encryption. But that's the case in your question as well. But there are certain modes of operation, which achieve both at the same time, called "authenticated encryption" $\endgroup$
    – tylo
    Commented Nov 16, 2016 at 11:12
  • $\begingroup$ Thanks tylo, so this example has no form of encryption at all and therefore no confidentiality has been given to the content of the message? $\endgroup$ Commented Nov 16, 2016 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.