52
$\begingroup$

On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.

What exactly is the difference between an HMAC and a hash of a span of input data?

Improve this question
$\endgroup$

3 Answers 3

Reset to default
62
$\begingroup$

TL;DR, an HMAC is a keyed hash of data.

A good cryptographic hash function provides one important property: collision resistance. It should be impractical to find two messages that result in the same digest.

An HMAC also provides collision resistance. But it also provides unforgeability. In order to generate an HMAC, one requires a key. If you only share this key with trusted parties, given an HMAC signature, you can be confident that only one of the trusted parties could have generated that signature.

Due to common properties of hash functions, an HMAC is not as simple as hashing the data appended to the key. This construct is vulnerable to length-extension attacks where an attacker can take a message and its HMAC signature, and use this to construct a longer message with a valid signature (thus breaking the guarantee of unforgeability).

Improve this answer
$\endgroup$
2
  • 8
    $\begingroup$ Please note that "HMAC" is a specific construction of a MAC (from a hash function), and most of your description applies to MACs in general. $\endgroup$
    – Paŭlo Ebermann
    Commented Feb 27, 2013 at 21:13
  • 1
    $\begingroup$ If we use HMAC-SHA3 or HMAC-SHA512-384, the length extensions are no longer valid. $\endgroup$
    – kelalaka
    Commented Dec 14, 2019 at 20:12
29
$\begingroup$

Put simply, if you're using a simple hash of a file to guarantee file-integrity, then an attacker could modify the file, re-calculate the hash of the modified file, and replace the old hash with the modified one. With a HMAC, a key is used when calculating the hash value, so unless the attacker has the key, they're unable to calculate a valid hash value of the modified data.

Improve this answer
$\endgroup$
3
  • 2
    $\begingroup$ So how are well-intended users supposed to securely receive this key so they can calculate the hash of the file? Or does this refer only to peer-to-peer, private sharing of files? $\endgroup$
    – Paul Razvan Berg
    Commented Dec 8, 2018 at 17:15
  • 2
    $\begingroup$ It's preshared crypto.stackexchange.com/questions/10371/… $\endgroup$
    – scape
    Commented Feb 27, 2019 at 16:29
  • 3
    $\begingroup$ HMACs fall into the domain of symmetric cryptography. Symmetric essentially means that two corresponding operations (such as encryption and decryption, or signing and verifying) use the same key. In terms of a HMAC, that means someone who can verify a HMAC can also create one. Asymmetric cryptography such as public-key schemes offer primitives to decouple these operations. For example, digital signature schemes use a private key to create a signature, and a corresponding public key to verify such a signature without giving the ability to create a new one. $\endgroup$
    – Lukas
    Commented Feb 27, 2020 at 22:48
2
$\begingroup$

The recent question concerned proper usage of hash functions as part of key derivation functions. A HMAC is a Pseudo Random Function, in the (informal) sense that if someone chooses a function F which is either a HMAC with a secret key, or a function selected at random from the set of all functions with the same domain and value set, you can't tell which is which.

A Hash function OTOH formally only has to meet certain criteria, such as primary preimage resistance, secondary preimage resistance and collision resistance. These criteria do not necessarily imply that the lower and upper halves of a digest value are independent, in the sense required for the purpose at hand.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.