After reading many posts, I am still confused about the differences between these two.

Let me know if my understanding is correct:

MAC is encrypted string that is generated using a secret key and a message, and it's used to check no-repudiation.

HMAC is a MAC that is generated using a hash function and it's used to the check the integrity of the message.

Some questions below:

  • Is HMAC an extra security layer over MAC?
  • Should HMAC be always used instead MAC?
  • In which scenario are both used? on TLS?
  • $\begingroup$ Apart from the last bullet, this is a duplicate of What is the difference between MAC and HMAC? and in this form, this question is too broad. $\endgroup$ – kelalaka Sep 12 '19 at 12:02
  • $\begingroup$ Yes, I have already read that post before but I still don't know if my understanding is correct. $\endgroup$ – fox_haunter Sep 12 '19 at 12:46
  • 1
    $\begingroup$ Short answer: HMAC is a specific way of building a MAC, much like an apple is a specific kind of fruit. So none of your questions really makes sense: Does an apple taste better than a fruit? $\endgroup$ – yyyyyyy Sep 12 '19 at 13:59
  • $\begingroup$ if you read that post, which was extremely clear, and still do not understand, I dont think we can help $\endgroup$ – Richie Frame Sep 12 '19 at 13:59

Browse other questions tagged or ask your own question.