On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.
What exactly is the difference between an HMAC and a hash of a span of input data?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
TL;DR, an HMAC is a keyed hash of data.
A good cryptographic hash function provides one important property: collision resistance. It should be impractical to find two messages that result in the same digest.
An HMAC also provides collision resistance. But it also provides unforgeability. In order to generate an HMAC, one requires a key. If you only share this key with trusted parties, given an HMAC signature, you can be confident that only one of the trusted parties could have generated that signature.
Due to common properties of hash functions, an HMAC is not as simple as hashing the data appended to the key. This construct is vulnerable to length-extension attacks where an attacker can take a message and its HMAC signature, and use this to construct a longer message with a valid signature (thus breaking the guarantee of unforgeability).
Put simply, if you're using a simple hash of a file to guarantee file-integrity, then an attacker could modify the file, re-calculate the hash of the modified file, and replace the old hash with the modified one. With a HMAC, a key is used when calculating the hash value, so unless the attacker has the key, they're unable to calculate a valid hash value of the modified data.
The recent question concerned proper usage of hash functions as part of key derivation functions. A HMAC is a Pseudo Random Function, in the (informal) sense that if someone chooses a function F which is either a HMAC with a secret key, or a function selected at random from the set of all functions with the same domain and value set, you can't tell which is which.
A Hash function OTOH formally only has to meet certain criteria, such as primary preimage resistance, secondary preimage resistance and collision resistance. These criteria do not necessarily imply that the lower and upper halves of a digest value are independent, in the sense required for the purpose at hand.