{
  "slug": "hmac",
  "term": "HMAC",
  "aliases": [
    "Hash-based message authentication code",
    "Keyed-hash message authentication code"
  ],
  "definition": "HMAC is a message authentication code constructed from a cryptographic hash function and a shared secret key.",
  "note": "Generating and checking a tag uses the secret key. HMAC authenticates the covered bytes under the chosen algorithm and key assumptions; it does not encrypt them. HMAC-SHA-256 is one specific instantiation. [rfc2104] [rfc4231]\n\nA payload-only tag does not by itself establish a storage address or version. The surrounding protocol must bind the intended context, for example through unambiguous authenticated fields checked against trusted expectations. A previously valid record can still pass its tag check when replayed under the same key. [hesela-hmac]\n\nThe authenticated input must preserve field boundaries. Hesela's selected address/generation pairs produce identical concatenated bytes even with the same role label; the fixed tuple distinguishes them. This is an encoding ambiguity, not an HMAC collision. [hesela-encoding]\n\nThe original MAC security model requires a forgery on a message not previously authenticated. Replaying an already valid message/tag pair is outside that event, so freshness remains a protocol responsibility. [bck1996]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "Authentication does not provide confidentiality, repair damaged data or establish that a storage write survived a crash.",
      "citationIds": [
        "rfc2104",
        "hesela-hmac"
      ]
    },
    {
      "text": "A valid tag does not establish freshness or distinguish which holder of the shared key generated it.",
      "citationIds": [
        "rfc2104",
        "hesela-hmac"
      ]
    }
  ],
  "related": [
    "cryptographic-hash",
    "checksum",
    "authenticated-encryption",
    "dm-integrity",
    "replay-attack",
    "rollback-protection",
    "message-authentication-code",
    "hash-domain-separation"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "rfc2104",
      "title": "RFC 2104: HMAC construction and shared-key authentication, sections 1-2",
      "url": "https://www.rfc-editor.org/rfc/rfc2104.html",
      "accessed": "2026-10-21"
    },
    {
      "id": "rfc4231",
      "title": "RFC 4231: HMAC-SHA-256 instantiation and test cases 1 through 6",
      "url": "https://www.rfc-editor.org/rfc/rfc4231.html",
      "accessed": "2026-10-22"
    },
    {
      "id": "hesela-hmac",
      "title": "Hesela: HMAC authenticates bytes, not the expected version",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#hmac-context",
      "accessed": "2026-10-21"
    },
    {
      "id": "hesela-encoding",
      "title": "Hesela: A role label does not separate the fields",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#hmac-field-encoding",
      "accessed": "2026-10-22"
    },
    {
      "id": "bck1996",
      "title": "Bellare, Canetti and Krawczyk (1996): MAC security definition, section 2.1",
      "url": "https://cseweb.ucsd.edu/~mihir/papers/kmd5.pdf",
      "accessed": "2026-10-22"
    }
  ],
  "updated": "2026-10-22",
  "provenance": [
    "RFC 2104 is used for the construction, not its historical MD5 or SHA-1 recommendations.",
    "The storage-context and replay examples are deterministic synthetic fixtures using a public test key, not device measurements or a security proof."
  ]
}