In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal information about plaintext in contrast to HMAC. Is my understanding right?

What are other security properties of MAC and HMAC?

  • 4
    $\begingroup$ I would like to note here that the term MAC is often used in two different ways: 1. a generic term for a message authentication code and 2. a term that is used for a block cipher based MAC (e.g. CBC-MAC, CMAC) - mainly to distinguish it from HMAC. Note that HMAC is a specific scheme as Seth correctly describes; SHA-3 uses KMAC which is therefore another hash based MAC. Maybe the acronyms CBMAC and HBMAC could be used for Cipher Based MAC's and HBMAC for Hash Based MAC's? $\endgroup$
    – Maarten Bodewes
    Commented Mar 2, 2017 at 15:55

2 Answers 2


A Message Authentication Code (MAC) is a string of bits that is sent alongside a message. The MAC depends on the message itself and a secret key. No one should be able to compute a MAC without knowing the key. This allows two people who share a secret key to send messages to each without fear that someone else will tamper with the messages. (At least, if someone does tamper with a message, this can be detected by checking to see if the MAC is right.)

The term "MAC" can refer to the string of bits (also called a "tag") or to the algorithm used to generate the tag.

HMAC is a recipe for turning hash functions (such as MD5 or SHA256) into MACs. So HMAC-MD5 and HMAC-SHA256 are specific MAC algorithms, just like QuickSort is a specific sorting algorithm.

There are other ways of constructing MAC algorithms; CMAC, for example, is a recipe for turning a blockcipher into a MAC (giving us CMAC-AES, CMAC-DES, CMAC-PRINCE, and the like).

Some MAC algorithms use IVs. Others, such as HMAC, do not.

MAC algorithms should have the security property of being unforgeable under chosen-message attacks. Let's say that Alice and Bob share a secret MAC key (which they use when sending messages to each other), and that Eve is spying on them and sees both their messages and the corresponding tags. Eve should not be able to use what she learns to fake valid tags. This should even be true if Eve can convince Bob to send specific messages.

For example, pretend Eve tells Bob to send the message:

Dear Alice,

Eve said "hi."

Love, Bob

and then Eve sees the corresponding tag. Eve should still be unable to "fake" the tag for the message:

Dear Alice,

Please give Eve $100 for me. I'll pay you back.

Love, Bob

In addition to being unforgeable under chosen-message attacks (UF-CMA), HMAC has the stronger property of being a pseudo-random function (PRF). This means that if Eve doesn't know the key, then all of Bob's HMAC tags look like completely random strings of bits, even if Eve knows or even chooses what messages Bob sends. This is a stronger property because every PRF is UF-CMA (you can't guess a big random number), but not every UF-CMA MAC algorithm is a PRF (it's possible that for some MAC algorithm, all the tags begin with 10 zeroes --- not very random-looking at all, but the other bits could still be hard to guess without knowing the key).

  • 2
    $\begingroup$ I think this answer is quite direct and comprehensive in response to the question. $\endgroup$
    – Scarl
    Commented Feb 9, 2016 at 6:51
  • $\begingroup$ HMAC, in addition to being usable as a PRF, inherits the one-way-ness and collision resistance of its underlying hash function. A generic PRF provides no protection if the key is known. One could craft a message, with the key, that results in a chosen PRF output value. For HMAC that's impossible, whether someone knows the key or not. (Assuming the hash is secure and HMAC output is not truncated to a length where that's brute-force-able.) $\endgroup$ Commented Mar 3, 2020 at 21:08

A MAC is a general term describing message authentication code. That is a tag that will verify the integrity of your data. You are be able to say whether or not an attacker has tampered with the data that you receive. One construction is HMAC and it uses a hash function as a basic building block. There is another way which is CBC-MAC and its improved version CMAC and is based on block ciphers.

  • 2
    $\begingroup$ Ok, MAC is a general term. And, HMAC or CMAC are specific constructions. Let us drop or forget these specific constructions. What is MAC then? Is it just then an idea without a specific implementation? $\endgroup$
    – daparic
    Commented Apr 24, 2021 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.