TLS Finished message: is it MAC or HMAC

Question

In several academic literature, the term Finished MACs is used frequently. I wonder, is it really a MAC or HMAC? I am looking at literature in TLS 1.2 vs. TLS 1.2 specs. The specs of TLS 1.2 Finished messages Here says: Structure of this message:

  struct {
      opaque verify_data[verify_data_length];
  } Finished;

  verify_data
     PRF(master_secret, finished_label, Hash(handshake_messages))
        [0..verify_data_length-1];

  finished_label
     For Finished messages sent by the client, the string
     "client finished".  For Finished messages sent by the server,
     the string "server finished".

As far as I know, if PFR are used, then it is HMAC not a MAC. Can you clarify to me please:

1) In TLS, is it Finished MACs or Finished HMACs? when some literature uses Finished MACs, is it correct (i.e. is it acceptable abbreviaton)?

2) Is it correct to use MAC instead of HMAc for short?

Answer 1

Is it correct to use MAC instead of HMAC for short?

In general, no.
MAC is a much more general concept than HMAC and thus such an equivalence in saying is clearly inacceptable. However, if you are talking about a specific protocol which authenticates its payload, saying "the MAC" to designate the MAC algorithm or the tag for messages, even if they use HMAC, is fully acceptable, because you are referring to the use of the more general concept with the concrete instantiation here.

---

Now to answer the question in the title (which will also catch question #1):

TLS Finished message: is it MAC or HMAC?

The answer is both.
Yes, HMAC is always used here to compute the (correct) PRF value, which is only possible if the same transcript was seen and the same master_secret was generated. Thus the authentication is built-in.

However, prior to this message, the ChangeCipherSpec message was sent for the record-layer protocol, enabling the use of the negotiated cipher suite. So the Finished message is actually send using the (now) encrypted and authenticated record-layer protocol, which does use the MAC specified in the cipher suite (e.g. GMAC or Poly1305).

The relevant quote from the RFC is:

The ChangeCipherSpec message is sent during the handshake after the security parameters have been agreed upon, but before the verifying Finished message is sent.

Answer 2

As far as I know, if PRF are used, then it is HMAC not a MAC.

Well, first off, HMAC is a type of MAC.

A MAC is a cryptographical primitive with certain security properties (approximately, if you don't know the key, then it's hard to predict the output for any given input).

HMAC is a specific design that yields a MAC; it uses a hash function internally.

Now, every TLS ciphersuite I know about (and I just checked the IANA ciphersuite registry) uses an HMAC as the PRF; however, this might not guaranteed to remain true. For example, it would not be surprising if someone designed a ciphersuite using KMAC (a SHA-3 based MAC)

To address your questions:

1) In TLS, is it Finished MACs or Finished HMACs?

Yes, obviously.

2) Is it correct to use MAC instead of HMAC for short?

That's sort of like saying "is it correct to say 'dog' instead of 'poodle'"