Message Authentication Code (MAC) – Notes
1. Definition
• Message Authentication Code (MAC) is a short piece of information used to verify the
integrity and authenticity of a message.
• Generated using a secret key + message through a cryptographic algorithm.
• Ensures that the message is not altered and is from a genuine sender.
2. Purpose of MAC
1. Integrity – Detects if the message was modified during transmission.
2. Authentication – Verifies sender identity (since secret key is shared).
3. Non-repudiation (partial) – Sender cannot deny sending message.
3. Working Principle
1. Sender and Receiver share a secret key.
2. Sender runs the MAC algorithm on the message + key → produces MAC value (tag).
3. Message + MAC value is sent to receiver.
4. Receiver recomputes MAC using the same secret key.
o If values match → message is authentic.
o If values differ → message is altered.
4. Types of MAC Algorithms
1. Hash-based MAC (HMAC)
o Uses a cryptographic hash function (SHA-256, MD5).
o Formula: HMAC = Hash(Key ⊕ opad || Hash(Key ⊕ ipad || message))
o Widely used in SSL, TLS, IPsec.
2. Block Cipher-based MAC (CMAC)
o Uses block cipher like AES/3DES.
o More secure than plain hashing.
3. Universal Hashing (UMAC/VMAC)
o Uses universal hashing + one-time pad.
o Very fast, suitable for high-speed networks.
5. Difference between MAC & Digital Signature
MAC Digital Signature
Requires shared secret key Uses private/public key pair
Provides authentication + integrity Provides authentication, integrity, and non-repudiation
Faster, less computational cost Slower (uses asymmetric cryptography)
6. Applications of MAC
• Internet Protocol Security (IPSec) → Ensures secure communication.
• Transport Layer Security (TLS/SSL) → For website authentication.
• Banking Transactions → To prevent fraud.
• Wireless Security (WPA2) → Uses HMAC-SHA1.
• Software Updates → To ensure integrity of downloaded files.
7. Advantages
• Provides strong integrity + authentication.
• Efficient and fast.
• Works well in real-time applications.
8. Limitations
• Requires secure key distribution between sender & receiver.
• Does not provide true non-repudiation (since both share same key).