28
$\begingroup$

On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.

What exactly is the difference between an HMAC and a hash of a span of input data?

$\endgroup$
37
$\begingroup$

TL;DR, an HMAC is a keyed hash of data.

A good cryptographic hash function provides one important property: collision resistance. It should be impractical to find two messages that result in the same digest.

An HMAC also provides collision resistance. But it also provides unforgeability. In order to generate an HMAC, one requires a key. If you only share this key with trusted parties, given an HMAC signature, you can be confident that only one of the trusted parties could have generated that signature.

Due to common properties of hash functions, an HMAC is not as simple as hashing the data appended to the key. This construct is vulnerable to length-extension attacks where an attacker can take a message and its HMAC signature, and use this to construct a longer message with a valid signature (thus breaking the guarantee of unforgeability).

$\endgroup$
  • 5
    $\begingroup$ Please note that "HMAC" is a specific construction of a MAC (from a hash function), and most of your description applies to MACs in general. $\endgroup$ – Paŭlo Ebermann Feb 27 '13 at 21:13
16
$\begingroup$

Put simply, if you're using a simple hash of a file to guarantee file-integrity, then an attacker could modify the file, re-calculate the hash of the modified file, and replace the old hash with the modified one. With a HMAC, a key is used when calculating the hash value, so unless the attacker has the key, they're unable to calculate a valid hash value of the modified data.

$\endgroup$
  • $\begingroup$ So how are well-intended users supposed to securely receive this key so they can calculate the hash of the file? Or does this refer only to peer-to-peer, private sharing of files? $\endgroup$ – Paul Berg Dec 8 '18 at 17:15
  • $\begingroup$ It's preshared crypto.stackexchange.com/questions/10371/… $\endgroup$ – scape Feb 27 at 16:29
2
$\begingroup$

The recent question concerned proper usage of hash functions as part of key derivation functions. A HMAC is a Pseudo Random Function, in the (informal) sense that if someone chooses a function F which is either a HMAC with a secret key, or a function selected at random from the set of all functions with the same domain and value set, you can't tell which is which.

A Hash function OTOH formally only has to meet certain criteria, such as primary preimage resistance, secondary preimage resistance and collision resistance. These criteria do not necessarily imply that the lower and upper halves of a digest value are independent, in the sense required for the purpose at hand.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.