Message authentication code

1 Fundamentals

A message authentication code is a compact value computed from a message and a secret key. Its main role is to let the receiver confirm that the message came from someone who knows the key and that the contents have not been changed in transit. In practice, a MAC is attached to the message, transmitted together with it, and checked on receipt.

1.1 Definition and purpose

A MAC is a keyed checksum-like value, but unlike a simple checksum it is designed to resist deliberate tampering. The sender computes the tag from the message and secret key, and the receiver recomputes it using the same key. If the results match, the message is accepted as authentic within the limits of the scheme.

MACs are used whenever two parties need a lightweight way to verify message integrity and origin. They are especially common in communication systems, where messages may cross untrusted networks or pass through intermediate systems.

1.2 Integrity and authenticity

Integrity means that the message has not been altered, while authenticity means that the message was created by a party with access to the shared key. A MAC can support both goals at once. If even one bit of the protected data changes, the tag should no longer verify.

A MAC does not reveal whether a message is meaningful, correct, or safe in a broader sense. It only indicates whether the transmitted data matches what the key holder authenticated.

1.3 Shared-key model

MACs rely on symmetric cryptography. The sender and receiver must both know the same secret key, or keys derived from a shared secret. This model is efficient and straightforward, but it works best in closed systems where trusted parties can securely distribute and store keys.

Because the same key is used to create and verify tags, MACs do not provide public verifiability. Anyone who knows the key can also generate valid tags, so they are not suitable when the proof must be checkable by third parties.

1.4 MACs versus hashes and digital signatures

A hash function processes data without a secret key. It is useful for detecting accidental changes, but on its own it does not stop an attacker from replacing both the message and the hash. A MAC adds secret-key protection, which gives it stronger security against active forgery.

Digital signatures also protect integrity and authenticity, but they use public-key algorithms. That makes them more flexible for open verification and nonrepudiation, but typically slower and more computationally costly than MACs. MACs are usually preferred when both sides already share a secret and speed matters.

2 Cryptographic principles

The design of a MAC is based on the idea that only someone with the correct key should be able to produce a valid tag for a message. The construction must remain secure even when attackers can observe many message-tag pairs and may choose messages adaptively.

2.1 Secret-key algorithms

A MAC algorithm combines a secret key with the message through a carefully defined transformation. Common designs use block ciphers, hash functions, or universal hashing as building blocks. The security of the final tag depends on both the construction and the strength of the underlying primitive.

A good MAC must behave unpredictably to outsiders, even when the algorithm itself is known. This follows the general cryptographic principle that security should depend on key secrecy rather than obscurity of the method.

2.2 Security goals

The central goal of a MAC is to make unauthorized tag creation impractical. Even if an attacker can see many valid tags, they should not be able to produce a new valid pair for a message that has not already been authenticated under the same key.

2.2.1 Unforgeability

Unforgeability is the defining security property of a MAC. It means that, without the key, an adversary cannot feasibly create a fresh message-tag pair that will be accepted by the verifier. Modern MACs aim for existential unforgeability under chosen-message attack, a strong notion that allows attackers to request tags on messages of their choice.

2.2.2 Collision resistance in context

MACs are not usually evaluated by classical collision resistance in the same way as unkeyed hashes. Two different messages producing the same tag is expected to be possible in principle when tags are short, but the key question is whether an attacker can deliberately find such a pair or forge a valid tag. The relevant measure is resistance to practical forgery, not merely accidental overlap.

2.3 Information-theoretic and computational security

Some MACs are secure only under computational assumptions, meaning that attacks are infeasible for realistic adversaries but not impossible in principle. Others can offer information-theoretic security, where the tag reveals no exploitable advantage even to an attacker with unlimited computing power, provided the key is used correctly and only once or under strict limits.

Computational MACs are far more common because they are efficient and scalable. Information-theoretic schemes are valuable in specialized settings, especially where message volume and key handling can be tightly controlled.

3 Common MAC constructions

Several families of MACs have become widely used in practice. They differ in the cryptographic primitive they rely on and in the trade-offs they offer between speed, simplicity, and resistance to misuse.

3.1 Block-cipher-based MACs

Block-cipher-based MACs build tags from a symmetric encryption primitive such as AES. They are common in systems that already depend on block ciphers and need a standardized authentication method.

3.1.1 CBC-MAC

CBC-MAC applies a block cipher in a chaining mode over the message blocks and uses the final value as the tag. It is simple and efficient, but its basic form is secure only for messages of fixed length. If used incorrectly with variable-length data, it can become vulnerable to forgery.

3.1.2 CMAC

CMAC is an improved block-cipher MAC designed to address the weaknesses of plain CBC-MAC. It uses subkeys and a carefully defined final-block treatment so that it works securely for messages of varying length. CMAC is a standard choice in many modern systems.

3.1.3 PMAC

PMAC is a parallelizable MAC based on a block cipher. Unlike serial chaining methods, it can process different parts of the message concurrently, which makes it attractive for high-performance implementations. Its design aims to combine efficiency with strong provable security.

3.2 Hash-based MACs

Hash-based MACs combine a secret key with a cryptographic hash function. They are popular because hash functions are fast, widely available, and well studied.

3.2.1 HMAC

HMAC is the best-known hash-based MAC. It wraps a hash function in a specific keyed construction that avoids several weaknesses found in naive keying methods. HMAC is widely deployed and has been standardized for many protocols.

3.2.2 NMAC

NMAC is a closely related construction in which the hash function is keyed in a more direct way. It is conceptually important in the theory of keyed hashing and helped motivate later designs such as HMAC. In practice, HMAC is usually more common in applications.

3.3 Universal-hash-based MACs

Universal-hash-based MACs use a fast algebraic hash combined with a secret key and often a separate finalization step. They are valued for high speed, especially in software and hardware implementations that process large amounts of data.

3.3.1 UMAC

UMAC is a high-speed MAC design that uses universal hashing and a final encryption step to produce the tag. It is intended for environments where throughput is important and overhead must be kept low.

3.3.2 Poly1305

Poly1305 is a widely used universal-hash-based MAC that operates efficiently on modern processors. It produces a short authentication tag and is often paired with a stream cipher or used within authenticated encryption schemes. Its design is known for both speed and simplicity.

4 Operation and verification

In normal use, a MAC system follows a straightforward sequence: the sender computes a tag, transmits message and tag together, and the receiver checks whether the received tag matches the expected result.

4.1 Tag generation

To generate a tag, the sender inputs the message and key into the MAC algorithm. The result is a fixed-length value, often called an authentication tag. This tag is appended to the message or transmitted alongside it.

The tag should depend on the entire message, so that any alteration changes the computed result. Robust implementations also define precisely how message length and formatting are handled.

4.2 Tag comparison

The receiver recomputes the tag from the received message using the shared key. The computed value is then compared with the received tag. If they match, the message is accepted; otherwise, it is rejected.

Comparison should be performed in a way that does not leak useful timing information. A constant-time comparison is commonly used to reduce the risk that an attacker can infer the correct tag byte by byte.

4.3 Message formatting and encoding

A MAC algorithm usually requires a definite encoding of the input message. This includes how fields are serialized, how lengths are represented, and where boundaries occur between components. Clear formatting is essential, because ambiguous encoding can lead to verification errors or security flaws.

Protocol designers often specify exactly what bytes are covered by the MAC. This may include headers, sequence numbers, payload data, or auxiliary fields such as version values.

4.4 Truncation of tags

Tags are sometimes truncated to reduce bandwidth or storage use. Truncation lowers the amount of information carried by the tag, which also reduces security against guessing attacks. The shorter the tag, the easier it becomes for an attacker to try random forgeries.

Truncation can be acceptable when the threat model is limited and the system compensates with other safeguards. The chosen tag length should match the value of the protected data and the expected attack environment.

5 Applications

MACs appear in many security systems because they are efficient, versatile, and easy to integrate into existing communication designs.

5.1 Secure communications

In secure channels, MACs protect message integrity after encryption or alongside other security mechanisms. They help ensure that packets, frames, or application messages are not modified by attackers or corrupted in transit.

MACs are often used in conjunction with encryption, especially when the goal is to keep data confidential and authenticated at the same time. In such systems, the authentication step is crucial because encryption alone does not guarantee integrity.

5.2 Authentication in network protocols

Many network protocols use MACs to authenticate packets, control messages, or session traffic. They can protect routing data, handshake exchanges, and state updates. In these settings, the tag is often computed over both the payload and selected header fields.

Because network communication may be exposed to packet injection and modification, MAC verification is a common defense. It helps protocols distinguish legitimate traffic from crafted forgeries.

5.3 Software and firmware integrity

MACs may be used to verify updates, firmware images, or configuration files when the verifying party shares a secret with the publisher. This can help detect tampering before code is installed or executed.

In closed ecosystems, a MAC can provide a lightweight integrity check for trusted deployment channels. However, if the verifier must be able to prove validity to outsiders, a digital signature is usually more appropriate.

5.4 File and data protection

MACs can protect stored files, database records, backups, or archives when those items are handled within a trusted key-sharing environment. They are useful for detecting unauthorized changes to sensitive information at rest.

For long-term storage, key management becomes especially important. If the key is lost, the tag can no longer be verified; if the key is exposed, an attacker may be able to create valid tags for altered data.

6 Design considerations

Choosing a MAC involves balancing security, performance, and ease of deployment. The best design depends on the type of data, the expected threat model, and the operational constraints of the system.

6.1 Key length and management

Keys should be long enough to resist guessing and stored with appropriate protection. A strong MAC cannot compensate for poor key handling. Secure generation, distribution, rotation, and revocation are all central to a sound deployment.

When many users or devices are involved, careful key separation is important. Reusing the same key across unrelated systems can create avoidable risk and complicate incident response.

6.2 Tag length and security level

Tag length directly influences the difficulty of brute-force forgery. Longer tags provide stronger protection, while shorter tags reduce overhead but give attackers more opportunities to guess a valid value. Designers typically select a length that matches the sensitivity of the protected data.

The effective security level also depends on how many verification attempts an attacker can make. A short tag may be adequate in a low-traffic setting but weak in a system exposed to many online trials.

6.3 Randomized versus deterministic schemes

Most MACs are deterministic: the same message and key produce the same tag. This is efficient and easy to verify, but it means that repeated messages reveal repeated tags. Some systems add nonces, sequence numbers, or timestamps to prevent replay and to bind authentication to a specific context.

Randomization can improve certain usage patterns, but it also adds complexity. In many protocols, the extra state needed for nonces or counters is used to achieve freshness rather than to randomize the MAC itself.

6.4 Resistance to misuse

A robust MAC should remain secure under realistic implementation errors, though no design can survive every possible misuse. Developers must follow the algorithm’s rules for message length, key separation, and input formatting. Using a construction outside its intended domain can quickly undermine security.

Misuse resistance also includes practical concerns such as side-channel safety, safe comparison routines, and protection against key leakage. These operational details matter as much as the core cryptographic formula.

7 Attacks and limitations

MACs are strong tools, but they do not solve every security problem. Their protection is limited to the correctness of the authenticated data under the shared key.

7.1 Replay attacks

A replay attack occurs when an adversary captures a valid message-tag pair and sends it again later. A MAC alone does not necessarily stop this, because the repeated message still has a valid tag. To prevent replay, systems often include sequence numbers, timestamps, or nonce-based freshness checks.

7.2 Forgery attempts

The main attack against a MAC is the attempt to generate a valid tag without the key. Attackers may try random guessing, exploit structural weaknesses, or use information gained from poorly designed protocols. Strong MACs are built so that these efforts remain computationally impractical.

7.3 Key reuse problems

Reusing a key in multiple roles or across incompatible algorithms can weaken security. A key intended for one MAC construction should not automatically be reused for another purpose unless the system is designed for that arrangement. Key reuse can create subtle interactions that are difficult to audit.

Poor key lifecycle management can also lead to exposure over time. Once a key is compromised, all data protected by that key may need to be treated as suspect.

7.4 Vulnerable constructions

Not every keyed authentication method is safe. Some naive schemes, especially those built by simply appending a key to a hash input, can be broken by extension or structural attacks. Others are secure only under restricted message lengths or specific formatting rules.

This is why standardized MAC constructions are preferred over ad hoc designs. Established methods are analyzed to avoid the common pitfalls that arise from informal keying techniques.

8 Standards and implementations

MACs are standardized in many cryptographic frameworks and are commonly implemented in operating systems, libraries, hardware modules, and communication protocols.

8.1 NIST recommendations

Standardization bodies such as NIST have published guidance on authenticated algorithms and keyed hashing. These recommendations help ensure that implementations follow vetted designs and that tag lengths, key sizes, and usage rules are selected appropriately.

Standards are especially useful because they reduce ambiguity. They provide a common reference for developers, auditors, and protocol designers.

8.2 ISO and IEEE usage

International standards organizations and technical bodies have incorporated MACs into a range of security profiles and communication specifications. Their use often appears in link-layer protections, storage formats, and industrial systems where interoperable authentication is needed.

Standard references help align implementations across vendors and platforms, which is important when security depends on consistent behavior.

8.3 Protocol integration

MACs are frequently embedded in larger protocols rather than used alone. The protocol must define exactly what is authenticated, when the tag is computed, and how verification failures are handled. These details can be as important as the algorithm itself.

Good protocol integration also considers ordering, freshness, and error reporting. If these are poorly designed, attackers may still learn useful information or exploit differences in system behavior.

8.4 Software libraries and APIs

Common cryptographic libraries expose MAC functions through programming interfaces that accept a key, message, and output buffer for the tag. Well-designed APIs reduce the chance of misuse by making initialization, update, and finalization steps explicit.

Library support often includes multiple MAC choices so developers can select one appropriate for the platform. High-quality implementations pay close attention to constant-time operations and safe handling of secret material.

9 Related concepts

MACs belong to a broader family of authentication and integrity mechanisms. Understanding their neighbors helps clarify when a MAC is the best tool and when another primitive is preferable.

9.1 Message authentication versus encryption

Encryption hides message content, while authentication verifies that the content has not been altered and that it came from an authorized source. These are different goals, and one does not automatically provide the other.

A secure system often uses both. Confidentiality protects privacy, while a MAC protects against tampering and impersonation.

9.2 Authenticated encryption

Authenticated encryption combines confidentiality and integrity in a single design. It is widely used in modern secure communication systems because it reduces the chance of deploying encryption without authentication. Many authenticated encryption schemes internally use a MAC or MAC-like component.

9.3 Digital signatures

Digital signatures provide authentication with public verification. They are useful when the verifier should not need a shared secret or when proof must be transferable to third parties. Compared with MACs, signatures are usually less efficient but more flexible in open environments.

9.4 One-time authentication codes

One-time authentication codes are specialized MAC-like schemes designed for very limited use, often with information-theoretic security. They can be extremely strong under strict key and usage constraints, but they are less practical for general-purpose communication than conventional MACs.